feat(apps): tell a guest why they were bounced to the login page (D3)

A guest tapping a personal page — orders, transactions, profile,
favourites, complete-profile — was redirected in silence, so they landed
on the login box with nothing explaining what happened. Legacy showed
«ابتدا وارد شوید» (henza_pwa/src/router/index.ts:259).

The message is now shown in both apps. The destination deliberately
stays the target's /login?redirect=…, which legacy did not have: legacy
sent the guest to home and lost where they were going, while here
signing in returns them to the page they asked for. The owner chose that
trade-off, so it is logged as «عمداً تکرار نشد — D3/الف» rather than
quietly left as a divergence. The guard also keys off meta.requiresAuth
instead of legacy's hand-kept list of five route names, so the two
sales-expert pages are covered too.

Legacy's isLoaded router guard is NOT ported, and the reasoning is
written into both apps' configStore beside the line that says so: it
guarded legacy's one big bootstrap request, which this target does not
have, so it would guard nothing and only add a bounce — a shared product
link would open home instead of the product. That is porting the
breakage, not the behaviour (D4).

Route analytics is deferred at the owner's request; its design is parked
in docs/PHASE2-D3-PLAN.md so it need not be re-derived, along with the
two reference defects not to copy (log/create was unauthenticated and
accepted any title; log/update was a GET that wrote) and the open
retention and IP questions.

Seven of D3's ten items turned out to be built already — all five
screens in both apps, the sts_verify_step_two guard, v2's cart ceiling —
verified in the code rather than from the checkmarks.

Neither app has a test runner: verified with vue-tsc -b on both (clean)
plus confirming the toast can actually appear, not merely compile —
toast.info exists and <ToastHost /> is mounted in each App.vue.

اپ: وقتی بدون ورود صفحه شخصی را باز کنید، پیام «ابتدا وارد شوید» نشان داده می‌شود.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/CHANGELOG.md

@@ -876,3 +876,56 @@ earlier ruling this deviation stays, and it is re-recorded in `ISSUES.md` so it
 is not "fixed" later by someone restoring parity for its own sake.
 
 _No data was deleted in this entry._
+
+---
+
+## 2026-10-12 — Phase 2 — item #2: D3's three outstanding behaviours
+
+- **What:** (1) A guest bounced off a personal page now sees «ابتدا وارد شوید»
+  in both apps. (2) Legacy's `isLoaded` router guard is recorded as deliberately
+  not ported. (3) Route analytics parked as ANLY-01.
+- **Why:** D3's remaining items. Seven of its ten were already built — all five
+  screens in **both** apps, the `sts_verify_step_two` guard and v2's cart stock
+  ceiling — confirmed by reading the code rather than trusting the checkmarks.
+- **Reference:** `henza_pwa/src/router/index.ts:253-261` (the notify + home),
+  `:263-266` (the `isLoaded` guard), `router/customAnalytics.ts` +
+  `henza_server/app/Http/Controllers/Api/LogController.php` (analytics).
+- **Target:** both apps' `src/router/index.ts` and `src/stores/configStore.ts`.
+- **Matrix row:** APP-03, APP-04, ANLY-01 in `ISSUES.md` §"Phase 2 — item #2".
+- **Commit:** see below.
+
+**The one judgement call.** Legacy showed the toast and then sent the guest to
+`home`, discarding where they were going. The target redirected to `/login` with
+`query.redirect`, so signing in returns the guest to the page they wanted — that
+part is better than the reference, and the gap was only the missing message.
+Rather than choose silently, the trade-off went to the owner, who kept the
+target's destination. So the message is the parity row and the destination is
+**«عمداً تکرار نشد — D3/الف»**. The guard also keys off `meta.requiresAuth`
+instead of legacy's hand-kept list of five route names, which means the two
+sales-expert pages are covered too.
+
+**`isLoaded` — argued against, and the owner agreed.** It guarded legacy's one
+big bootstrap request, which the target does not have (each page fetches its own
+data). Added, it would guard nothing and introduce a bounce: a shared product
+link would open `home` instead of the product. That is porting the breakage, not
+the behaviour (D4). The reasoning is written into both apps' `configStore.ts`,
+beside the line that says the flag was not ported, so the next reader finds it
+where they would actually look.
+
+**Analytics deferred by the owner** («ج اصلا اولیوت نداره»). The design is kept
+in `docs/PHASE2-D3-PLAN.md` so it does not have to be re-derived, including the
+two reference defects not to copy — `log/create` was unauthenticated and took any
+title, so anyone could fill the table from outside, and `log/update` was a `GET`
+that wrote — plus the two questions only the owner can answer: how long to keep
+per-customer browsing history (legacy never deleted it) and whether to store the
+IP at all.
+
+**Verification.** Neither app has a test runner, so the check is `vue-tsc -b` on
+both (clean) plus reading the three things that make the toast actually appear
+rather than merely compile: `toast.info` exists (`composables/useToast.ts:66`),
+`<ToastHost />` is mounted in each `App.vue:25`, and the call sits before the
+guard's `return`. A compiling toast with no host would have been invisible.
+Noted in the code: with the IAM enabled, silent SSO leaves the page before this
+guard runs, so the toast is a no-op there by design, not a defect.
+
+_No data was deleted in this entry._