feat(apps): tell a guest why they were bounced to the login page (D3)

A guest tapping a personal page — orders, transactions, profile,
favourites, complete-profile — was redirected in silence, so they landed
on the login box with nothing explaining what happened. Legacy showed
«ابتدا وارد شوید» (henza_pwa/src/router/index.ts:259).

The message is now shown in both apps. The destination deliberately
stays the target's /login?redirect=…, which legacy did not have: legacy
sent the guest to home and lost where they were going, while here
signing in returns them to the page they asked for. The owner chose that
trade-off, so it is logged as «عمداً تکرار نشد — D3/الف» rather than
quietly left as a divergence. The guard also keys off meta.requiresAuth
instead of legacy's hand-kept list of five route names, so the two
sales-expert pages are covered too.

Legacy's isLoaded router guard is NOT ported, and the reasoning is
written into both apps' configStore beside the line that says so: it
guarded legacy's one big bootstrap request, which this target does not
have, so it would guard nothing and only add a bounce — a shared product
link would open home instead of the product. That is porting the
breakage, not the behaviour (D4).

Route analytics is deferred at the owner's request; its design is parked
in docs/PHASE2-D3-PLAN.md so it need not be re-derived, along with the
two reference defects not to copy (log/create was unauthenticated and
accepted any title; log/update was a GET that wrote) and the open
retention and IP questions.

Seven of D3's ten items turned out to be built already — all five
screens in both apps, the sts_verify_step_two guard, v2's cart ceiling —
verified in the code rather than from the checkmarks.

Neither app has a test runner: verified with vue-tsc -b on both (clean)
plus confirming the toast can actually appear, not merely compile —
toast.info exists and <ToastHost /> is mounted in each App.vue.

اپ: وقتی بدون ورود صفحه شخصی را باز کنید، پیام «ابتدا وارد شوید» نشان داده می‌شود.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/stores/configStore.ts

@@ -17,6 +17,14 @@
 //                HomeSlider's popup/link/discount click handling works unchanged.
 //
 // Not ported (no backend): promotionList, ignoreList, priceList, isLoaded.
+//
+// `isLoaded` — «عمداً تکرار نشد — D3/ب» (owner, 2026-10-12). Legacy used it as a
+// router guard: a signed-in user whose one big bootstrap request had not landed
+// was sent to `home` from any route lacking `meta.skipLoadedCheck`
+// (henza_pwa/src/router/index.ts:263-266). The target has no such bootstrap —
+// every page fetches its own data — so the flag would guard nothing and only
+// add a bounce: opening a shared product link would land on home instead of the
+// product. Replicating it would port the breakage, not the behaviour (D4).
 import { defineStore } from 'pinia'
 import { useCatalogStore } from './catalogStore'
 import shippingArt from '../assets/img/shipping-and-delivery.png'