feat: add auth store, login, callback, and protected route

Adds Zustand auth store with JWT parsing (sub, roles, organization_id),
Logto OIDC login page, authorization code callback handler, and
ProtectedRoute guard. Also adds vite-env.d.ts for import.meta.env types.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/vite-env.d.ts

@@ -0,0 +1 @@
+/// <reference types="vite/client" />