fix(auth+pwa): resolve stuck-loading race condition and PWA build error

Auth: `getSession()` in a SvelteKit load function races with Supabase's async
localStorage init and can return null for a valid session, triggering a spurious
login() redirect. Moved auth redirect to (app)/+layout.svelte via $effect, which
correctly waits for onAuthStateChange to fire. Also fixed collective data never
loading on page refresh (INITIAL_SESSION event, not SIGNED_IN).

PWA: SvelteKit blocks Workbox imports in src/service-worker.ts, preventing
@vite-pwa/sveltekit from finding the compiled SW output. Switched to generateSW
strategy (plugin auto-generates the SW). Custom SW deferred to Fase 2b using
src/sw.ts (a filename SvelteKit does not intercept).

Docs: added gotchas 6–8 to CLAUDE.md covering both root causes so they are not
reintroduced. Updated plan/fase-2b with the sw.ts workaround note.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

setup.sh

@@ -138,6 +138,9 @@ SUPABASE_SERVICE_ROLE_KEY=${SERVICE_KEY}
 # ── Keycloak ──────────────────────────────────────────────────────────────────
 KEYCLOAK_ADMIN=admin
 KEYCLOAK_ADMIN_PASSWORD=admin
+# Client secret for colectivo-web (confidential client, used by GoTrue).
+# Dev-only value — matches keycloak/realm-export.json. Override for production.
+KEYCLOAK_CLIENT_SECRET=gotrue-dev-secret
 
 # ── Public endpoints ──────────────────────────────────────────────────────────
 PUBLIC_SUPABASE_URL=http://localhost:8001