Fix the no-org redirect loop and swallowed Google sign-in errors

Redirect chain traced across middleware.ts, ChromeSwitcher.tsx and
AuthProvider.tsx before touching anything, per the ask. Those three were
already correct as of c7f985d/2a1d52b/83416fe (middleware exempts
/onboarding and /signup from the drb_session cookie gate, ChromeSwitcher
sends any signed-in no-org user to /onboarding, AuthProvider only sets the
cookie once an org_id claim exists). The actual loop was one file upstream
of all three: app/login/page.tsx hardcoded `router.push("/dashboard")`
after both the email/password and Google handlers resolved. That push
races AuthProvider's async onAuthStateChanged -> getIdTokenResult ->
cookie decision. For a no-org account the cookie never gets set, so
middleware bounces the very next request back to /login with no
explanation — the ping-pong the coordinator saw live.

Fix: login page no longer navigates from the handlers. It waits on
AuthProvider's own `loading`/`orgId` and redirects once claims are
settled (/dashboard with org_id, /onboarding without). This also fixes a
second case: a user who lands on /login already signed in (e.g. bounced
there by middleware while their Firebase session was still valid) now
gets routed the same way instead of sitting inert on a login form with no
feedback. /onboarding itself (org-name form, single action) was already
adequate as the "explain the state" screen once the loop stopped
recreating it.

Also, live tonight: Google sign-in was failing outright in prod with no
console/network trace. app/login/page.tsx's Google handler did
`catch { setError("Google sign-in failed. Try again.") }` — no binding,
error discarded. Added lib/authErrors.ts: logs the raw error, and maps
Firebase codes to messages that distinguish two categories — the user's
own situation (popup blocked/closed, bad password, network) says "try
again"; deployment misconfiguration (auth/unauthorized-domain,
auth/operation-not-allowed) says so explicitly and does not suggest
retrying, since retrying can't fix a missing authorized-domain entry or a
disabled provider. Applied to both handlers in login/page.tsx and both
in signup/page.tsx (same swallowing pattern, same fix). Per the
coordinator's steer: this is diagnosis only — no popup-to-redirect
fallback, no auth method change. If production is hitting
auth/unauthorized-domain, that's a Firebase Console fix
(drb.cusano.net -> Authorized domains), not a code fix.

Nav.tsx: sign-out was only reachable from /profile. Added a profile
dropdown (desktop) and drawer entries (mobile) with Profile / Refresh
access / Sign out, so sign-out is reachable from anywhere in the app.

"Refresh access" calls AuthProvider.refreshClaims() (already existed,
already used by /onboarding after signup) so a user whose role or org
was just changed server-side can pick it up without a full logout.

Decision on unknown Google accounts (point 4): kept self-serve org
creation via /onboarding rather than a "request access" pending state.
BUSINESS_MODEL.md #2.1 already answers this for the owner: "a limited
free public tier *and* full paid access without contributing... cash is
the primary revenue line from day one." A pending-approval gate would
contradict that — it would make org creation itself the thing being
gated, when the model explicitly does not want contribution (or approval)
to be the only door. Self-serve org provisioning via POST /auth/signup
was already built for this (2a1d52b) and needed no further gating
decision, just for the loop in front of it to stop.

Reversible: no schema change, no new gating, no billing/Stripe touched.
Bench: rsync'd to the WSL-native ~/drb-frontend workspace and ran
`npx tsc --noEmit` there (per CLAUDE.md — the H: drive install path is
not viable) — exit 0, no errors. No Python touched this pass.

drb-frontend/lib/authErrors.ts

@@ -0,0 +1,55 @@
+/**
+ * Maps Firebase Auth error codes to user-facing messages instead of
+ * discarding them. Two categories:
+ *
+ *   - misconfiguration: something is wrong with *our* deployment (a domain
+ *     not on the authorized list, a sign-in provider not enabled in the
+ *     Firebase console). Retrying can never fix these — the message says so
+ *     instead of "try again", which would send a user into a retry loop
+ *     against a config problem only we can fix.
+ *   - everything else: the user's own situation (blocked/closed popup, bad
+ *     password, a network blip) — retrying might well work.
+ *
+ * Always logs the raw error so it isn't silently discarded — the point of
+ * this file is to stop swallowing that information, not just relabel it.
+ */
+
+export interface AuthErrorInfo {
+  message: string;
+  misconfiguration: boolean;
+}
+
+const MISCONFIGURATION_MESSAGES: Record<string, string> = {
+  "auth/unauthorized-domain":
+    "This domain isn't authorized for sign-in yet. That's a configuration issue on our end (Firebase Console → Authentication → Settings → Authorized domains) — retrying won't fix it. Please report this.",
+  "auth/operation-not-allowed":
+    "This sign-in method isn't enabled for this app yet. That's a configuration issue on our end (Firebase Console → Authentication → Sign-in method) — retrying won't fix it. Please report this.",
+};
+
+const USER_MESSAGES: Record<string, string> = {
+  "auth/popup-blocked": "Your browser blocked the sign-in popup. Allow popups for this site and try again.",
+  "auth/popup-closed-by-user": "Sign-in window was closed before finishing. Try again.",
+  "auth/cancelled-popup-request": "Sign-in was interrupted by another sign-in attempt. Try again.",
+  "auth/network-request-failed": "Network error — check your connection and try again.",
+  "auth/invalid-credential": "Invalid email or password.",
+  "auth/wrong-password": "Invalid email or password.",
+  "auth/user-not-found": "Invalid email or password.",
+  "auth/too-many-requests": "Too many attempts. Wait a few minutes and try again.",
+  "auth/email-already-in-use": "An account with this email already exists. Try signing in instead.",
+  "auth/weak-password": "Password is too weak — use at least 6 characters.",
+};
+
+export function describeAuthError(err: unknown, fallback: string): AuthErrorInfo {
+  const code = (err as { code?: string } | null | undefined)?.code;
+
+  // eslint-disable-next-line no-console
+  console.error("[auth]", code ?? "(no error code)", err);
+
+  if (code && MISCONFIGURATION_MESSAGES[code]) {
+    return { message: MISCONFIGURATION_MESSAGES[code], misconfiguration: true };
+  }
+  if (code && USER_MESSAGES[code]) {
+    return { message: USER_MESSAGES[code], misconfiguration: false };
+  }
+  return { message: fallback, misconfiguration: false };
+}