fix: login/logout flow — protected routes + redirect to login on logout

- Logout now redirects to /auth/login?provider=local instead of /
- Dashboard / and /workspace check auth and redirect to login if no session
- _get_user_or_redirect() helper added for reusable auth checks
- No more fallback admin user on dashboard — explicit login required
- Routes without session redirect to login page

app/routers/auth.py

@@ -272,8 +272,8 @@ async def callback(
 
 @router.get("/logout")
 async def logout():
-    """Clear session and redirect to dashboard."""
-    response = RedirectResponse(url="/", status_code=302)
+    """Clear session and redirect to login page."""
+    response = RedirectResponse(url="/auth/login?provider=local", status_code=302)
     response.delete_cookie("flowdeck_session")
     return response