fix: force full-document navigation on auth-route redirects

[nandan-bhat]

Summary

The SDK route guards and redirect helpers send users to /auth/* routes like /auth/login and /auth/logout. These routes are served by the auth0Middleware at the HTTP layer. They are not registered in the TanStack Router route tree.

Because of this, a client-side navigation (through <Link>, router.navigate(), or a beforeLoad that runs without a full page load) made the router try to match /auth/login inside its own route tree. That match failed and the router returned Not Found (404).

This happened because TanStack Router only auto-enables reloadDocument for absolute URLs. Our redirects use relative paths like /auth/login, so the flag stayed off and the router handled them internally instead of letting the browser reach the server.

The fix sets reloadDocument: true on every SDK redirect that targets an auth route. This forces a real browser navigation so the request reaches auth0Middleware. Full page loads and SSR were never affected, because the server handles the redirect before the router runs.

Changes

• Set reloadDocument: true on all 7 redirect sites:
  • requireAuth and requireOrg in src/client/guards.ts
  • login and logout in src/client/imperative.ts
  • requireAuthMiddleware and requireOrgMiddleware in src/server/middleware.ts
• Added tests that assert each redirect carries reloadDocument: true.

Testing

• Build, lint, and the full test suite pass.