Fix router redirect breaking OTP flow on both apps

AsyncLoading during OTP request was redirecting from /login to /splash,
bouncing users back to login. Now auth routes stay put during loading —
only redirect to splash from non-auth routes (initial app startup).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

client_app/lib/router.dart

@@ -38,8 +38,11 @@ GoRouter buildRouter(Ref ref) {
       final isAuthRoute = state.matchedLocation.startsWith('/auth') ||
           state.matchedLocation == '/welcome';
 
-      // Show splash while loading
-      if (authState is AsyncLoading) return isSplash ? null : '/splash';
+      // Show splash only during initial load — don't redirect away from auth routes
+      if (authState is AsyncLoading) {
+        if (isSplash || isAuthRoute) return null;
+        return '/splash';
+      }
 
       final data = authState.valueOrNull;
       if (data == null) {