fix: prevent unauthorized API calls before authentication

- Add global AuthGuard component to handle authentication at layout level
- Make all API query hooks conditional on authentication status
- Define public routes (like /transcripts/new) that don't require auth
- Fix login flow to use NextAuth signIn instead of non-existent /login route
- Prevent 401 errors by waiting for auth token before making API calls

Previously, all routes under (app) were publicly accessible with each page
handling auth individually. Now authentication is enforced globally while
still allowing specific routes to remain public.

www/app/lib/apiClient.tsx

@@ -10,10 +10,10 @@ import {
 } from "@tanstack/react-query";
 import createFetchClient from "openapi-react-query";
 
-// Create the base openapi-fetch client
+// Create the base openapi-fetch client with a default URL
+// The actual URL will be set via middleware in ApiAuthProvider
 export const client = createClient<paths>({
-  // Base URL will be set dynamically via middleware
-  baseUrl: "",
+  baseUrl: "http://127.0.0.1:1250",
   headers: {
     "Content-Type": "application/json",
   },