[codex] Move app UI into Leptos and guard app route

[legokichi]

Summary

• move the public home/login surfaces into the Leptos app shell and keep logged-in /login redirected to /
• port the browser map layer UI into the Leptos app
• guard /app so unauthenticated requests are redirected to /
• fix server function routing so /api/<endpoint> reaches the Leptos server function registry without losing the /api prefix
• avoid hydrating SSR-only public pages to prevent auth-state hydration mismatches

Root Cause

The app defined server functions with #[server(prefix = "/api", ...)], but the Axum router used .nest("/api", ...). That stripped the /api prefix before the request reached the Leptos server function handler, so /api/list_rivers was looked up as /list_rivers and failed.

The public SSR pages also rendered with server-side auth state, while the browser-side hydration path did not have the same auth context. Full-body hydration on / and /login therefore produced mismatched HTML after login.

Validation

• cargo fmt --all
• DATABASE_URL='sqlite://.local/river-dev.db?mode=rwc' cargo test -p server -p app -p frontend
• make test-e2e
• manually checked unauthenticated /app returns 303 Location: /
• manually checked / no longer reports a hydration mismatch in the browser console