feat(auth): wire AuthProvider + RequireAuth into app shell

src/auth/api.test.ts

@@ -23,7 +23,7 @@ describe("auth/api fetch wrapper", () => {
       statusText: "Unauthorized",
       headers: new Headers(),
       json: async () => ({ error: "session_expired" }),
-    } as Response);
+    } as unknown as Response) as unknown as typeof globalThis.fetch;
 
     // Stub window.location.href setter to capture navigation without
     // actually navigating (jsdom does not implement location.href assignment).
@@ -54,7 +54,7 @@ describe("auth/api fetch wrapper", () => {
       statusText: "Forbidden",
       headers: new Headers(),
       json: async () => ({ error: "forbidden" }),
-    } as Response);
+    } as unknown as Response) as unknown as typeof globalThis.fetch;
     Object.defineProperty(window, "location", {
       configurable: true,
       get: () => ({
@@ -75,7 +75,7 @@ describe("auth/api fetch wrapper", () => {
       status: 200,
       headers: new Headers(),
       json: async () => ({ hello: "world" }),
-    } as Response);
+    } as unknown as Response) as unknown as typeof globalThis.fetch;
     const { authedFetch } = await import("./api");
     const data = await authedFetch("/api/anything");
     expect(data).toEqual({ hello: "world" });