feat(apps): tell a guest why they were bounced to the login page (D3)

A guest tapping a personal page — orders, transactions, profile,
favourites, complete-profile — was redirected in silence, so they landed
on the login box with nothing explaining what happened. Legacy showed
«ابتدا وارد شوید» (henza_pwa/src/router/index.ts:259).

The message is now shown in both apps. The destination deliberately
stays the target's /login?redirect=…, which legacy did not have: legacy
sent the guest to home and lost where they were going, while here
signing in returns them to the page they asked for. The owner chose that
trade-off, so it is logged as «عمداً تکرار نشد — D3/الف» rather than
quietly left as a divergence. The guard also keys off meta.requiresAuth
instead of legacy's hand-kept list of five route names, so the two
sales-expert pages are covered too.

Legacy's isLoaded router guard is NOT ported, and the reasoning is
written into both apps' configStore beside the line that says so: it
guarded legacy's one big bootstrap request, which this target does not
have, so it would guard nothing and only add a bounce — a shared product
link would open home instead of the product. That is porting the
breakage, not the behaviour (D4).

Route analytics is deferred at the owner's request; its design is parked
in docs/PHASE2-D3-PLAN.md so it need not be re-derived, along with the
two reference defects not to copy (log/create was unauthenticated and
accepted any title; log/update was a GET that wrote) and the open
retention and IP questions.

Seven of D3's ten items turned out to be built already — all five
screens in both apps, the sts_verify_step_two guard, v2's cart ceiling —
verified in the code rather than from the checkmarks.

Neither app has a test runner: verified with vue-tsc -b on both (clean)
plus confirming the toast can actually appear, not merely compile —
toast.info exists and <ToastHost /> is mounted in each App.vue.

اپ: وقتی بدون ورود صفحه شخصی را باز کنید، پیام «ابتدا وارد شوید» نشان داده می‌شود.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/router/index.ts

@@ -5,6 +5,7 @@ import { useTransitionStore } from '../stores/transitionStore';
 import { api } from '../api/client';
 import { useCachedReads } from '../api/cachedReads';
 import { afterPageLeave } from '../composables/usePageTransition';
+import { toast } from '../composables/useToast';
 
 // Legacy lazy-loaded every route component (`component: () => import(...)`) so
 // the initial bundle only carries the entry route. Matched here.
@@ -136,7 +137,25 @@ router.beforeEach(async (to) => {
   if (to.name === 'login' && session.isLoggedIn) {
     return { name: 'home' };
   }
+  // D3 — legacy told the guest why they were bounced
+  // (henza_pwa/src/router/index.ts:253-261: `showNotify('ابتدا وارد شوید')`),
+  // and the target redirected in silence, so tapping «سفارش‌های من» landed on
+  // the login box with nothing explaining it.
+  //
+  // «عمداً تکرار نشد — D3/الف»: legacy then sent the guest to `home` and lost
+  // where they were going. The owner chose to keep the target's `redirect`, so
+  // signing in returns them to the page they asked for. The message is the
+  // parity row; the destination is deliberately better.
+  //
+  // Legacy listed five route names; the target gates on `meta.requiresAuth`,
+  // which also covers the two sales-expert pages — the same rule, applied
+  // wherever it belongs instead of a hand-kept list.
+  //
+  // Only reached when the IAM is off (the default) or unreachable: with silent
+  // SSO enabled the block above has already left the page, and a toast on a
+  // document that is being replaced would never be read. Not a gap.
   if (to.meta.requiresAuth && !session.isLoggedIn) {
+    toast.info('ابتدا وارد شوید');
     return { name: 'login', query: { redirect: to.fullPath } };
   }