fix(auth): secure sessions and app routing

Validate sessions against the API, honor configurable base paths, and route unknown pages to 404. Keep development ports stable so user and admin apps cannot be confused.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" href="/admin/favicon.ico">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>پنل مدیریت | پارچه</title>
-    <script type="module" crossorigin src="/admin/assets/index-Ce0o2VuJ.js"></script>
+    <script type="module" crossorigin src="/admin/assets/index-B2VD3zy8.js"></script>
     <link rel="stylesheet" crossorigin href="/admin/assets/index-C3X1YgAk.css">
   </head>
   <body>