fix: wire up 7-day consent re-prompt in AuthGuard

The shouldShowConsent function in the shared package had the correct
logic for checking analyticsConsentRemindAt, but the AuthGuard never
used it. The inline check only redirected to the consent page when
both analyticsEnabled and analyticsConsentShownAt were null, which
is never true after "remind later" since shownAt gets set.

- Destructure analyticsConsentRemindAt from useAuth session
- Hydrate remindAt into the analytics store instead of hardcoding null
- Replace inline redirect check with shouldShowConsent from shared pkg
- Read analyticsConfig from the store inside AuthGuard for serverEnabled

apps/web/src/App.tsx

@@ -1,4 +1,4 @@
-import { APP_VERSION } from "@snapotter/shared";
+import { APP_VERSION, shouldShowConsent } from "@snapotter/shared";
 import { Component, type ErrorInfo, lazy, type ReactNode, Suspense, useEffect } from "react";
 import { BrowserRouter, Navigate, Route, Routes, useLocation } from "react-router-dom";
 import { Toaster } from "sonner";
@@ -82,9 +82,11 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
     mustChangePassword,
     analyticsEnabled,
     analyticsConsentShownAt,
+    analyticsConsentRemindAt,
   } = useAuth();
   const storeConsent = useAnalyticsStore((s) => s.consent);
   const setStoreConsent = useAnalyticsStore((s) => s.setConsent);
+  const analyticsConfig = useAnalyticsStore((s) => s.config);
   const location = useLocation();
 
   // biome-ignore lint/correctness/useExhaustiveDependencies: only hydrate on session load, not on store changes
@@ -98,7 +100,7 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
       setStoreConsent({
         analyticsEnabled: analyticsEnabled ?? null,
         analyticsConsentShownAt: analyticsConsentShownAt ?? null,
-        analyticsConsentRemindAt: null,
+        analyticsConsentRemindAt: analyticsConsentRemindAt ?? null,
       });
     }
   }, [loading, analyticsEnabled, analyticsConsentShownAt, setStoreConsent]);
@@ -142,12 +144,15 @@ function AuthGuard({ children }: { children: React.ReactNode }) {
     return <Navigate to="/change-password" replace />;
   }
 
-  // Check both session state (useAuth) and real-time store state.
-  // After the consent page calls acceptAnalytics(), the store updates immediately
-  // but useAuth won't re-fetch until the next session check.
-  const effectiveEnabled = storeConsent.analyticsEnabled ?? analyticsEnabled;
-  const effectiveShownAt = storeConsent.analyticsConsentShownAt ?? analyticsConsentShownAt;
-  if (authEnabled && effectiveEnabled === null && effectiveShownAt === null) {
+  const effectiveConsent = {
+    analyticsEnabled: storeConsent.analyticsEnabled ?? analyticsEnabled ?? null,
+    analyticsConsentShownAt:
+      storeConsent.analyticsConsentShownAt ?? analyticsConsentShownAt ?? null,
+    analyticsConsentRemindAt:
+      storeConsent.analyticsConsentRemindAt ?? analyticsConsentRemindAt ?? null,
+  };
+  const serverEnabled = analyticsConfig?.enabled ?? false;
+  if (authEnabled && shouldShowConsent(effectiveConsent, serverEnabled)) {
     return <Navigate to="/analytics-consent" replace />;
   }