fix(auth+pwa): resolve stuck-loading race condition and PWA build error

Auth: `getSession()` in a SvelteKit load function races with Supabase's async
localStorage init and can return null for a valid session, triggering a spurious
login() redirect. Moved auth redirect to (app)/+layout.svelte via $effect, which
correctly waits for onAuthStateChange to fire. Also fixed collective data never
loading on page refresh (INITIAL_SESSION event, not SIGNED_IN).

PWA: SvelteKit blocks Workbox imports in src/service-worker.ts, preventing
@vite-pwa/sveltekit from finding the compiled SW output. Switched to generateSW
strategy (plugin auto-generates the SW). Custom SW deferred to Fase 2b using
src/sw.ts (a filename SvelteKit does not intercept).

Docs: added gotchas 6–8 to CLAUDE.md covering both root causes so they are not
reintroduced. Updated plan/fase-2b with the sw.ts workaround note.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/vite.config.ts

@@ -11,10 +11,11 @@ export default defineConfig({
 		}),
 		sveltekit(),
 		SvelteKitPWA({
-			srcDir: './src',
-			mode: 'development',
-			strategies: 'injectManifest',
-			filename: 'service-worker.ts',
+			// strategies defaults to 'generateSW' — the plugin auto-generates the service
+			// worker. We do NOT use 'injectManifest' here because SvelteKit's own Vite
+			// plugin intercepts src/service-worker.ts and blocks external imports (Workbox).
+			// In Fase 2b we will introduce a custom SW as src/sw.ts (a filename SvelteKit
+			// does not recognise as a service worker) and switch to injectManifest then.
 			scope: '/',
 			base: '/',
 			manifest: {
@@ -33,9 +34,6 @@ export default defineConfig({
 					{ src: '/icons/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'maskable' }
 				]
 			},
-			injectManifest: {
-				globPatterns: ['client/**/*.{js,css,ico,png,svg,webp,woff,woff2}']
-			},
 			workbox: {
 				globPatterns: ['client/**/*.{js,css,ico,png,svg,webp,woff,woff2}']
 			},