fix: redirect anonymous /app requests to /sign-in (SFE-01)

[georgestander]

Summary

• redirect unauthenticated GET /app (and nested app paths) to /sign-in
• preserve original target via redirectTo query param
• keep existing 401 response for non-page unauthorized requests

Scenario

• Scenario ID: SFE-01
• Pack: spk_31900281-0d3f-4da9-9351-c311da4ea960
• Manifest: smf_0ff0933a-0098-4cc5-b440-1177c753ff49

Validation

• Before fix (auth-required env): GET /app returned 401 Unauthorized
• After fix (auth-required env): GET /app returns 303 See Other with Location: /sign-in?redirectTo=%2Fapp
• pnpm types passed
• npm run test passed
• npm run lint passed