fix(auth): secure sessions and app routing

Validate sessions against the API, honor configurable base paths, and route unknown pages to 404. Keep development ports stable so user and admin apps cannot be confused.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/views/NotFoundView.vue

@@ -0,0 +1,35 @@
+<template>
+  <main class="not-found">
+    <p class="not-found__code">404</p>
+    <h1>صفحه پیدا نشد</h1>
+    <p>آدرسی که وارد کرده‌اید وجود ندارد.</p>
+    <RouterLink to="/">بازگشت به داشبورد</RouterLink>
+  </main>
+</template>
+
+<style scoped>
+.not-found {
+  display: grid;
+  min-height: 60vh;
+  place-content: center;
+  gap: 12px;
+  text-align: center;
+}
+
+.not-found__code {
+  margin: 0;
+  color: var(--color-primary, #c89b3c);
+  font-size: 72px;
+  font-weight: 800;
+}
+
+h1,
+p {
+  margin: 0;
+}
+
+a {
+  color: var(--color-primary, #c89b3c);
+  font-weight: 700;
+}
+</style>

src/views/auth/LoginView.vue

@@ -35,8 +35,12 @@ async function submit() {
   if (!ok) return
 
   toast.success(`خوش آمدید، ${auth.fullName}`)
-  const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
-  router.replace(redirect)
+  const requestedPath = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+  const basePath = import.meta.env.BASE_URL.replace(/\/$/, '')
+  const redirect = requestedPath.startsWith(basePath)
+    ? requestedPath.slice(basePath.length) || '/'
+    : requestedPath
+  await router.replace(redirect)
 }
 </script>