fix: login/logout flow — protected routes + redirect to login on logout

- Logout now redirects to /auth/login?provider=local instead of /
- Dashboard / and /workspace check auth and redirect to login if no session
- _get_user_or_redirect() helper added for reusable auth checks
- No more fallback admin user on dashboard — explicit login required
- Routes without session redirect to login page

app/routers/auth.py

@@ -272,8 +272,8 @@ async def callback(
 
 @router.get("/logout")
 async def logout():
-    """Clear session and redirect to dashboard."""
-    response = RedirectResponse(url="/", status_code=302)
+    """Clear session and redirect to login page."""
+    response = RedirectResponse(url="/auth/login?provider=local", status_code=302)
     response.delete_cookie("flowdeck_session")
     return response
 

app/routers/dashboard.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import logging
 
 from fastapi import APIRouter, Request, Query
-from fastapi.responses import HTMLResponse
+from fastapi.responses import HTMLResponse, RedirectResponse
 
 from app.services.gitea_client import gitea
 from app.auth.session import SessionManager
@@ -14,6 +14,14 @@ logger = logging.getLogger(__name__)
 router = APIRouter(tags=["dashboard"])
 
 
+def _get_user_or_redirect(request: Request):
+    """Return decoded user or a RedirectResponse to login page."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    return user
+
+
 def _sidebar_data(request: Request, repos: list[dict]) -> dict:
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     ws = user.get("login", "Bruno") if user else "Bruno"