fix: bootstrap-gate auth before mount (krypto-kuns pattern); never call API unauthenticated

Root cause: the router-guard adapter let index.vue mount and call the API before
auth resolved, so auth.fetch returned a synthetic 401 (the banner) and the package's
redirect-loop guard could strand the user. Now use the core ZitadelAuth and gate in an
async plugin (Nuxt awaits it before mount), mirroring the working krypto-kuns app.

app/pages/auth/callback.vue

@@ -1,11 +1,8 @@
 <script setup lang="ts">
-// The Zitadel client processes the OIDC redirect during init(); once authenticated,
-// move back to the app root.
-const { auth } = useAuth();
-watchEffect(() => {
-  if (!auth.isLoading.value && auth.isAuthenticated.value) {
-    navigateTo("/", { replace: true });
-  }
+// The auth plugin completes the OIDC code exchange during init() before mount.
+// This page just returns to the app root.
+onMounted(() => {
+  navigateTo("/", { replace: true });
 });
 </script>