feat(mall): authenticate against the live API

Wave 2 of replacing the fixed-data mock adapter: the auth domain joins the live
list, so credentials, roles and tokens belong to the real user.

- session: validate a restored token through /auth/me instead of trusting
  localStorage, clearing it on 401/403 but keeping it when the API is merely
  unreachable; the route guard now uses the validated session
- login: report a 401 as invalid credentials rather than a generic failure, and
  drop the 6-character client rule so the API owns the password policy
- register: raise the rule to the API's 8 characters, remove the
  verification-code field (its button only counted down and the value was never
  sent), and report a duplicate email (409) distinctly
- TopBar and the user profile render their session-dependent branch client-only:
  validating the session before hydration made those localStorage-backed
  branches report hydration mismatches the previous code did not

Verified against the running backend: wrong password rejected, real JWT issued,
/user reachable, a short password refused with no network call, duplicate email
reported, a tampered token cleared and bounced to sign-in, a stale token kept
when the API is down, and the fixed-data rollback still signs in with the
backend stopped.

Also re-cuts docs/TBD-migrate-wave.md: auth is done, and cart, orders,
shipments and invoices must move together, because the mock adapter keeps their
state in one shared object and a partial flip fails at checkout.

OpenSpec change: openspec/changes/replace-mock-api-wave-2

apps/mall/middleware/auth.ts

@@ -1,15 +1,10 @@
-export default defineNuxtRouteMiddleware(() => {
+export default defineNuxtRouteMiddleware(async () => {
   if (import.meta.server) return;
-  const token = localStorage.getItem("vmall.token");
-  let role: string | null = null;
-  try {
-    const raw = localStorage.getItem("vmall.user");
-    const user: unknown = raw ? JSON.parse(raw) : null;
-    if (user && typeof user === "object" && "role" in user && typeof user.role === "string") {
-      role = user.role;
-    }
-  } catch {
-    role = null;
-  }
-  if (!token || role !== "customer") return navigateTo("/login");
+  const session = useSessionStore();
+  if (!session.token) session.hydrate();
+  if (!session.token) return navigateTo("/login");
+  // Trust the auth API's answer rather than whatever localStorage claims; a
+  // rejected token clears the session inside validate().
+  if (!(await session.validate())) return navigateTo("/login");
+  if (session.user?.role !== "customer") return navigateTo("/login");
 });