- api/auth.js: persist access token in localStorage so it survives
  page reloads and works across domains (panel vs server IP).
- LoginPage.vue: on mount, check for access_token in URL query
  params (from OAuth callback) and initialize auth store.
- AuthController::callback(): append access_token + expires_in to
  the redirect URL so the SPA can capture it.

- Replace GnEmptyState with custom centered login card
- Add brand icon, title and subtitle
- Make 'Sign in with gnexus-auth' button large and full-width
- Show session-check spinner while authStore.init() runs
- Rebuild production dist/

Server:
- AuthControllerTrait now supports both session and Bearer token auth
  (resolves user from Authorization: Bearer header via shserv_sessions)

Vue client:
- Add api/auth.js module for access token management
- Inject Authorization: Bearer header in http.js
- Handle 401 in client.js: clear token + redirect to /auth/login
- New Pinia auth store (stores/auth.js): init, refreshToken, logout, hasPermission
- New usePermission composable
- Router guards: redirect unauthenticated to /login, permission-based route blocking
- New LoginPage.vue with gnexus-auth login button
- AppShell: conditional nav items by permission, user bar with logout
- main.js: initialize auth before mounting app
- MSW mocks: /auth/me, /auth/logout, /auth/refresh
- Fix AppShell.spec.js for Pinia + router setup

All 167 tests pass.