fix(auth): bootstrap auth state from getSession() before subscribing

[Bytes0211]

Summary

Both apps were relying solely on onAuthStateChange firing INITIAL_SESSION on mount to flip the loading state to false. In some browser/SDK combinations a restored session never produces that event, leaving the spinner stuck forever after a refresh — observed today on admin.dialtone.menu and kitchen.dialtone.menu after a fresh paid order.

Fix: extract the session handler so it can be called from both getSession() (immediate, fires once on mount) and onAuthStateChange (reactive, fires on future changes). Handler is idempotent, so a redundant INITIAL_SESSION fire is harmless.

Affects:

• apps/admin/src/lib/auth-context.tsx
• apps/kitchen/src/app.tsx

Test plan

• pnpm ci:fast passes (lint + typecheck + 188 unit tests)
• Sign in to admin.dialtone.menu, refresh page — confirm board renders without sticking on the spinner
• Same for kitchen.dialtone.menu
• Confirm normal sign-in / sign-out flow still works (handler called on SIGNED_IN and SIGNED_OUT events)

🤖 Generated with Claude Code

Greptile Summary

This PR fixes a stuck-spinner regression on page refresh by bootstrapping auth state from getSession() on mount (instead of relying solely on onAuthStateChange firing INITIAL_SESSION), then skipping INITIAL_SESSION in the listener to prevent duplicate DB queries. The pattern is applied consistently across both apps/admin and apps/kitchen.

Confidence Score: 5/5

Safe to merge — fixes a real UX regression with no new logic errors introduced.

Only P2 findings present (missing error logging on getSession()). The core fix is correct: getSession() is idempotent from localStorage, INITIAL_SESSION is safely filtered out to avoid double-fetching, and sign-in/sign-out flows through onAuthStateChange are unaffected.

No files require special attention beyond the minor getSession() error-logging suggestion.

Important Files Changed

Filename	Overview
apps/admin/src/lib/auth-context.tsx	Extracts inline handler into handleSession, bootstraps via getSession() on mount, and filters INITIAL_SESSION from the listener to prevent duplicate DB queries — error field from getSession() is silently dropped.
apps/kitchen/src/app.tsx	Applies the same bootstrap pattern as admin, adds a local Session type inferred from the Supabase client, removes the erroneous setAuthLoading(true) at handler entry, and filters INITIAL_SESSION — same silent getSession() error drop as admin.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant getSession
    participant handleSession
    participant onAuthStateChange
    participant DB

    Browser->>getSession: mount (useEffect)
    getSession-->>handleSession: session | null (immediate, from localStorage)
    handleSession->>DB: loadRestaurantContext / loadStaffAccess
    DB-->>handleSession: staff + restaurant rows
    handleSession->>Browser: setLoading(false)

    onAuthStateChange-->>Browser: INITIAL_SESSION (filtered out — skipped)

    note over Browser,onAuthStateChange: Future auth changes (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED)
    onAuthStateChange-->>handleSession: event + session
    handleSession->>DB: loadRestaurantContext / loadStaffAccess
    DB-->>handleSession: updated rows
    handleSession->>Browser: state updated

Loading

_{Reviews (2): Last reviewed commit: "fix(auth): address Greptile P1+P2 — skip..." | Re-trigger Greptile}

[Bytes0211]

Addressed both Greptile findings in e3d56a4:

P1 (kitchen flash): Removed setAuthLoading(true) from handleSession entry. The initial useState(true) already starts the spinner; we only ever flip to false. Matches the admin handler pattern. Eliminates the board → spinner → board flash possibility entirely.

P2 (duplicate DB queries): Listener now early-returns when event === 'INITIAL_SESSION'. getSession() bootstraps the initial state authoritatively; the listener only handles subsequent events (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED, USER_UPDATED). Reduces mount-time queries back to baseline (admin: 3, kitchen: 2). The original bug we set out to fix still resolves: if INITIAL_SESSION never fires, getSession() covers it.

pnpm ci:fast still green (188 unit tests pass, lint + typecheck clean).