Auth: Web dashboard — Login page + protected routes

[EricGrill]

Auth System — Web Step 2

Add login UI and route protection to the web dashboard.

New pages:

• web/src/pages/Login.tsx — email/phone + password form
• web/src/pages/AcceptInvite.tsx — registration via invite link (/invite/:token)
• web/src/components/ProtectedRoute.tsx — wrapper component

Route structure:

/login              — public
/invite/:token      — public
/                   — protected (any authenticated)
/employees          — protected (farm_owner, foreman, admin)
/payroll            — protected (farm_owner, admin)
/lots               — protected (farm_owner, foreman, admin)
/settings/members   — protected (farm_owner, admin)

Implementation:

• Login form with error handling + loading state
• AcceptInvite: fetch invite details, show farm/role, registration form
• ProtectedRoute wraps Outlet, checks AuthContext
• Redirect to /login with return URL
• After login, redirect back to original URL

Depends on: Web AuthContext
Design doc: docs/AUTH.md