fix(frontend): render OAuth consent during session restoration #715

This allows the OAuth consent route to render without waiting for restoration of the frontend's persisted session.

App.svelte used the global authentication state to decide whether or not to display its loading screen. On startup, initAuth() restores a persisted session by calling com.atproto.server.getSession.

If that request remains pending, auth.kind remains loading. This prevented every route from mounting, including /oauth/consent, leaving the browser on a blank loading screen after a successful OAuth login.

The consent route does not need to depend on the restored dashboard session since it loads and validates the pending authorization request through the /oauth/authorize/consent endpoint.

This PR has these changes:

• derive the current route before evaluating the global loading state
• allow only /oauth/consent to render while dashboard session restoration is pending
• continue waiting for locale initialization and OAuth callback processing
• keep all other routes behind the existing authentication loading state
• add regression tests for both the consent-route exception and the non-consent boundary.

All existing tests as well as this one pass with this as well.