The manager can log in on production #73

Problem

Login is built separately in the backend and the frontend. Nothing checks that they work together on the deployed app.

Goal

The manager signs in with Google on production, stays logged in, and every page and API call requires the session.

Scope

• Connect the login screen to the auth API.
• Handle expired or missing sessions by sending the manager to the login screen.
• Logout.

Considerations

• Cookies across the frontend and API domains need matching CORS and cookie settings, and the Google redirect URLs must include production.

Acceptance criteria

• Signing in with Google on production reaches the calendar for the user's hotel.
• A new user is taken through hotel setup and then reaches the calendar.
• When logged out, every page goes to login and every API call returns 401.
• Logout ends the session.