fix(routes): add pre-hydration auth redirects to all protected pages

Replaced slow $effect-based auth checks with synchronous IIFE scripts in <svelte:head> that run during HTML parsing, before Svelte hydration. Covers: /today, /admin, /admin/schedule, /manage, /notifications (admin-only), and /account (auth-required). All redirect via window.location.replace() with no page flash.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/routes/admin/+page.svelte

@@ -66,6 +66,20 @@
 	}
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<!-- Full page skeleton loading -->
 	<div class="mx-auto max-w-6xl space-y-6 p-6">