fix(login): redirect authenticated users before hydration

Uses a raw IIFE script in <svelte:head> that runs synchronously during HTML parsing, before Svelte hydration. Checks localStorage JWT and calls window.location.replace() for an instant redirect with no page flash.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/routes/login/+page.svelte

@@ -324,6 +324,23 @@
 	);
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (token) {
+					var payload = JSON.parse(atob(token.split('.')[1]));
+					if (payload.exp * 1000 > Date.now()) {
+						var path = payload.role === 'admin' ? '/today' : '/';
+						window.location.replace(path);
+					}
+				}
+			} catch(e) {}
+		})();
+	</script>
+</svelte:head>
+
 <div class="mx-auto flex w-full justify-center p-4 pt-2">
 	<div class="w-full max-w-md space-y-6">
 		<!-- Header -->

frontend/src/routes/login/+page.ts

@@ -1,23 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-import { resolve } from '$app/paths';
-import type { PageLoad } from './$types';
-
-export const load: PageLoad = async () => {
-	if (typeof window !== 'undefined') {
-		const token = localStorage.getItem('authToken');
-		if (token) {
-			try {
-				const payload = JSON.parse(atob(token.split('.')[1]));
-				if (payload.exp * 1000 > Date.now()) {
-					if (payload.role === 'admin') {
-						throw redirect(302, resolve('/today'));
-					}
-					throw redirect(302, resolve('/'));
-				}
-			} catch (e) {
-				if (e instanceof Error && e.name === 'RedirectError') throw e;
-			}
-		}
-	}
-	return {};
-};