fix(auth): bypass auth guard for static assets and favicon

Prevents redirect loop when backend is down — login page CSS/JS
would otherwise be redirected to /login.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/hooks.server.test.ts

@@ -39,6 +39,15 @@ describe('auth guard (hooks.server.ts handle)', () => {
 		expect(resolve).toHaveBeenCalledWith(event);
 	});
 
+	it.each(['/_app/immutable/chunks/app.js', '/favicon.ico'])(
+		'allows static asset %s without auth',
+		async (path) => {
+			const { event, resolve } = createEvent(path);
+			await handle({ event, resolve });
+			expect(resolve).toHaveBeenCalledWith(event);
+		}
+	);
+
 	it('redirects unauthenticated requests on protected routes', async () => {
 		const { event, resolve } = createEvent('/planner');
 		try {

frontend/src/hooks.server.ts

@@ -4,7 +4,12 @@ import { apiClient } from '$lib/server/api';
 
 const PUBLIC_ROUTES = ['/login', '/register', '/invite'];
 
+const STATIC_PREFIXES = ['/_app/', '/favicon'];
+
 function isPublicRoute(pathname: string): boolean {
+	if (STATIC_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {
+		return true;
+	}
 	return PUBLIC_ROUTES.some((route) => pathname === route || pathname.startsWith(route + '/'));
 }