fix(auth): secure sessions and app routing

Validate sessions against the API, honor configurable base paths, and route unknown pages to 404. Keep development ports stable so user and admin apps cannot be confused.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/views/auth/LoginView.vue

@@ -35,8 +35,12 @@ async function submit() {
   if (!ok) return
 
   toast.success(`خوش آمدید، ${auth.fullName}`)
-  const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
-  router.replace(redirect)
+  const requestedPath = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+  const basePath = import.meta.env.BASE_URL.replace(/\/$/, '')
+  const redirect = requestedPath.startsWith(basePath)
+    ? requestedPath.slice(basePath.length) || '/'
+    : requestedPath
+  await router.replace(redirect)
 }
 </script>