fix(auth+pwa): resolve stuck-loading race condition and PWA build error

Auth: `getSession()` in a SvelteKit load function races with Supabase's async
localStorage init and can return null for a valid session, triggering a spurious
login() redirect. Moved auth redirect to (app)/+layout.svelte via $effect, which
correctly waits for onAuthStateChange to fire. Also fixed collective data never
loading on page refresh (INITIAL_SESSION event, not SIGNED_IN).

PWA: SvelteKit blocks Workbox imports in src/service-worker.ts, preventing
@vite-pwa/sveltekit from finding the compiled SW output. Switched to generateSW
strategy (plugin auto-generates the SW). Custom SW deferred to Fase 2b using
src/sw.ts (a filename SvelteKit does not intercept).

Docs: added gotchas 6–8 to CLAUDE.md covering both root causes so they are not
reintroduced. Updated plan/fase-2b with the sw.ts workaround note.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/routes/(app)/+layout.ts

@@ -1,21 +1,9 @@
-import { browser } from '$app/environment';
-import { getSupabase } from '$lib/supabase';
-import { login } from '$lib/auth';
-
-// No SSR — this is a client-rendered PWA
+// No SSR — this is a client-rendered PWA.
+// Auth redirect is handled in +layout.svelte via the onAuthStateChange store,
+// NOT here. Using getSession() in a load function races with Supabase's async
+// localStorage initialisation and can return null for a valid session.
 export const ssr = false;
 
-export async function load() {
-	if (!browser) return {};
-
-	const {
-		data: { session }
-	} = await getSupabase().auth.getSession();
-
-	if (!session) {
-		// Not authenticated — redirect to Keycloak
-		await login();
-	}
-
+export function load() {
 	return {};
 }