feat(auth): add frontend role-based auth guards and session flow

[ayacoders]

Changes:

• add frontend auth session utilities (localStorage token/refresh-token handling)
• implement API auth middleware with:
  • bearer token injection
  • automatic refresh on 401
  • single retry with refreshed token
  • session clear + redirect to /auth on refresh failure
• add auth API helpers/hooks (fetchMe, useMe, useRefresh, useLogout)
• protect dashboard routes with auth/role guards
  • guard all dashboard routes behind authenticated /auth/me
  • restrict student routes to STUDENT
  • restrict faculty routes to FACULTY
  • redirect users with no roles to /auth
• update auth page bootstrap/login flow to redirect by role after /auth/me
• keep role routing focused on student/faculty for now
• refresh OpenAPI/Kubb generated schema/types files from latest contract