fix(auth): stop reload from redirecting logged-in users to /login

[zigzagdev]

Summary

• Bug: reloading an auth-required page (e.g. /mypage) while logged in redirected to /login, even though the token was still valid in localStorage
• Root cause: <StrictMode> double-invokes AuthProvider's effect in dev. The first invocation's getCurrentUser call gets aborted by React's Strict Mode cleanup, but AuthProvider didn't check for AbortError before calling setUser(null)/setLoading(false) — unlike every other hook in this codebase (useCreateUser, etc.), which all guard against acting on an aborted request's result. The aborted call's rejection resolved before the second (real) request finished, so RequireAuth briefly saw isLoading:false, user:null and navigated away before the real request could complete
• Fix: guard AuthProvider's getCurrentUser .catch/.finally with the same isAbortError check used elsewhere

Test plan

• npx tsc --noEmit
• npx jest — added a regression test that reproduces the StrictMode double-effect race; confirmed it fails against the pre-fix code and passes with the fix
• npm run format:check

[zigzagdev]

LGTM