fix: invalidate layout data after token exchange (#508)

after exchanging the OAuth token for a session cookie, the root
layout's load function still has stale data (isAuthenticated: false)
from before the cookie was set.

this caused navigation to /library immediately after login to redirect
to / because the layout data said the user wasn't authenticated.

the fix: call invalidateAll() after successful token exchange so
SvelteKit reruns all load functions with the new session cookie.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <[e-mail]>

frontend/src/routes/portal/+page.svelte

···
 <script lang="ts">
 	import { onMount } from 'svelte';
-	import { replaceState } from '$app/navigation';
+	import { invalidateAll, replaceState } from '$app/navigation';
 	import Header from '$lib/components/Header.svelte';
 	import HandleSearch from '$lib/components/HandleSearch.svelte';
 	import AlbumSelect from '$lib/components/AlbumSelect.svelte';
···
 				});
 
 				if (exchangeResponse.ok) {
+					// invalidate all load functions so they rerun with the new session cookie
+					await invalidateAll();
 					await auth.initialize();
 					await preferences.fetch();
 				}

frontend/src/routes/profile/setup/+page.svelte

···
 <script lang="ts">
 	import { APP_NAME } from '$lib/branding';
 	import { onMount } from 'svelte';
-	import { replaceState } from '$app/navigation';
+	import { invalidateAll, replaceState } from '$app/navigation';
 	import { API_URL } from '$lib/config';
 	import { auth } from '$lib/auth.svelte';
 
···
 				});
 
 				if (exchangeResponse.ok) {
+					// invalidate all load functions so they rerun with the new session cookie
+					await invalidateAll();
 					await auth.initialize();
 				}
 			} catch (_e) {

frontend/src/routes/settings/+page.svelte

···
 <script lang="ts">
 	import { onMount } from 'svelte';
+	import { invalidateAll } from '$app/navigation';
 	import Header from '$lib/components/Header.svelte';
 	import WaveLoading from '$lib/components/WaveLoading.svelte';
 	import type { TokenInfo } from '$lib/types';
···
 
 				if (exchangeResponse.ok) {
 					const data = await exchangeResponse.json();
+
+					// invalidate all load functions so they rerun with the new session cookie
+					await invalidateAll();
 
 					if (isDevToken) {
 						developerToken = data.session_id;