feat(web): redesign home page upload flow and add auth guard

Home page: after uploading an image, shows tool selector on the left
(quick actions + all 37 tools by category) with image preview on the
right. Stays on the main page — no popup overlay.

Auth: when AUTH_ENABLED=true, unauthenticated users are redirected to
/login. Default credentials admin/admin. When auth is disabled (dev
default), no redirect happens.

apps/web/src/hooks/use-auth.ts

@@ -0,0 +1,55 @@
+import { useState, useEffect } from "react";
+
+interface AuthState {
+  loading: boolean;
+  authEnabled: boolean;
+  isAuthenticated: boolean;
+}
+
+export function useAuth(): AuthState {
+  const [state, setState] = useState<AuthState>({
+    loading: true,
+    authEnabled: false,
+    isAuthenticated: false,
+  });
+
+  useEffect(() => {
+    checkAuth();
+  }, []);
+
+  async function checkAuth() {
+    try {
+      // Check if auth is enabled
+      const configRes = await fetch("/api/v1/config/auth");
+      const config = await configRes.json();
+
+      if (!config.authEnabled) {
+        setState({ loading: false, authEnabled: false, isAuthenticated: true });
+        return;
+      }
+
+      // Auth is enabled — check if we have a valid session
+      const token = localStorage.getItem("stirling-token");
+      if (!token) {
+        setState({ loading: false, authEnabled: true, isAuthenticated: false });
+        return;
+      }
+
+      const sessionRes = await fetch("/api/auth/session", {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+
+      if (sessionRes.ok) {
+        setState({ loading: false, authEnabled: true, isAuthenticated: true });
+      } else {
+        localStorage.removeItem("stirling-token");
+        setState({ loading: false, authEnabled: true, isAuthenticated: false });
+      }
+    } catch {
+      // Can't reach API — assume no auth needed (dev mode)
+      setState({ loading: false, authEnabled: false, isAuthenticated: true });
+    }
+  }
+
+  return state;
+}