v0.158.4: fix(auth): persist signup names, gate onboarding, improve auth messages

fix(auth): persist signup names, gate onboarding, improve auth messages

What

Four auth-flow issues surfaced by an end-to-end registration test on the live app.

1. Signup names were lost. The sign-up action stores first_name/last_name in auth metadata, but handle_new_user only read full_name (never set by the form) and ignored first/last name — profiles ended up with empty names and the app greeted users by their email. Migration 20260622210000 rewrites handle_new_user to persist first_name/last_name and derive full_name (prefers metadata full_name, else first+last), in both the shadow-link and new-user branches.
2. Onboarding could be skipped. The role/onboarding gate lived only in /auth/callback (OAuth + email-code path), so a password sign-in reached the dashboard with no role. Centralized the gate in the dashboard layout — role-less users redirect to /onboarding regardless of entry path.
3. 'Already registered' dead-ended invited users (told to sign in / reset a password they never set). Message now points invited users to their invitation email.
4. 'Email not confirmed' offered no recovery. The sign-in action flags that state and the page shows a 'Resend confirmation email' action.

Migration deployment note

⚠️ Migration 20260622210000 is applied to the StrummyProd stack. Applying it to the live self-hosted prod (StudentManager) needs care: that DB is schema-behind and may be missing user_roles, which handle_new_user references — apply a schema-aware variant or add the table first.

Tests

Pre-commit hook green (full Jest suite + lint).

🤖 Generated with Claude Code

---

Full Changelog: v0.158.3...v0.158.4
Merged PR: #517