feat: add auth guards and move legal pages to /legal

- Protected routes now redirect to timeline when not authenticated:
settings, edit-profile, create-gallery, notifications
- Moved terms, privacy, and copyright pages from /settings/* to /legal/*
so they remain publicly accessible
- Fixed logout to navigate before calling auth.logout()

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

src/components/pages/grain-app.js

···
       .register('/profile/:handle', 'grain-profile')
       .register('/settings', 'grain-settings')
       .register('/settings/profile', 'grain-edit-profile')
-      .register('/settings/terms', 'grain-terms')
-      .register('/settings/privacy', 'grain-privacy')
-      .register('/settings/copyright', 'grain-copyright')
+      .register('/legal/terms', 'grain-terms')
+      .register('/legal/privacy', 'grain-privacy')
+      .register('/legal/copyright', 'grain-copyright')
       .register('/create', 'grain-create-gallery')
       .register('/explore', 'grain-explore')
       .register('/notifications', 'grain-notifications')

src/components/pages/grain-create-gallery.js

···
 
   connectedCallback() {
     super.connectedCallback();
+
+    // Redirect to timeline if not authenticated
+    if (!auth.isAuthenticated) {
+      router.replace('/');
+      return;
+    }
+
     this._photos = draftGallery.getPhotos();
     if (!this._photos.length) {
       router.push('/');

src/components/pages/grain-edit-profile.js

···
 
   async connectedCallback() {
     super.connectedCallback();
+
+    // Redirect to timeline if not authenticated
+    if (!auth.isAuthenticated) {
+      router.replace('/');
+      return;
+    }
+
     await this.#loadProfile();
   }
 

src/components/pages/grain-notifications.js

···
 
   connectedCallback() {
     super.connectedCallback();
+
+    // Redirect to timeline if not authenticated
+    if (!auth.isAuthenticated) {
+      router.replace('/');
+      return;
+    }
+
     this._unsubscribe = auth.subscribe(user => {
       this._user = user;
       if (user) {

src/components/pages/grain-settings.js

···
 
   connectedCallback() {
     super.connectedCallback();
+
+    // Redirect to timeline if not authenticated
+    if (!auth.isAuthenticated) {
+      router.replace('/');
+      return;
+    }
+
     this._canInstall = pwa.canInstall;
     this._showIOSInstructions = pwa.showIOSInstructions;
     this.#unsubscribe = pwa.subscribe((canInstall) => {
···
   }
 
   #signOut() {
-    auth.logout();
     router.push('/');
+    auth.logout();
   }
 
   #goToTerms() {
-    router.push('/settings/terms');
+    router.push('/legal/terms');
   }
 
   #goToPrivacy() {
-    router.push('/settings/privacy');
+    router.push('/legal/privacy');
   }
 
   #goToCopyright() {
-    router.push('/settings/copyright');
+    router.push('/legal/copyright');
   }
 
   render() {