[feature] Prevent OS back button from reaching Auth pages

[coodos]

Prevent OS Back Button from Reaching Auth Pages When Logged In

Summary

Add navigation guards to prevent users from navigating back to verification, login, onboarding, or other auth pages via the OS back button or swipe gestures when they are already authenticated.
Problem

Currently, when a user is logged in and on a protected route (e.g., /main, /scan-qr, /settings), pressing the OS back button can navigate them back to authentication pages like /login, /verify, /onboarding, or /register. This is confusing UX and potentially a security concern.

Current Implementation

Authentication State (tracked in)

globalState.vaultController.vault - presence indicates authenticated session
globalState.isOnboardingComplete - indicates if onboarding flow is done
globalState.securityController.pinHash - indicates if user has set a PIN

Existing Guards

src/routes/(app)/+layout.svelte already redirects unauthenticated users to /login
Root +page.svelte redirects based on onboarding state

Missing

No reverse guard on (auth) routes to redirect authenticated users away from login/verify pages

Proposed Solution

Add onMount guards to auth pages that check if user is already authenticated and redirect to /main:

Affected Files

src/routes/(auth)/login/+page.svelte
src/routes/(auth)/verify/+page.svelte
src/routes/(auth)/onboarding/+page.svelte
src/routes/(auth)/register/+page.svelte
src/routes/(auth)/review/+page.svelte
src/routes/(auth)/e-passport/+page.svelte

Example Guard (for login page)

onMount(async () => {
 globalState = getContext<() => GlobalState>("globalState")();
 if (!globalState) {
 console.error("Global state is not defined");
 return;
 } // Redirect already-authenticated users to main
 const vault = await globalState.vaultController.vault;
 if (vault) {
 console.log("User already authenticated, redirecting to main");
 await goto("/main", { replaceState: true });
 return;
 } 
// ... rest of existing onMount logic});

Additional Consideration

Use goto("/main", { replaceState: true }) to replace history entry rather than push, preventing infinite back loops
Consider creating a shared auth layout (auth)/+layout.svelte with this check to avoid duplication

Acceptance Criteria

• User cannot navigate back to /login when already authenticated
• User cannot navigate back to /verify when already authenticated
• User cannot navigate back to /onboarding when onboarding is complete
• User cannot navigate back to /register when already registered
• Back button from /main should minimize app, not navigate to auth flow
• History state is properly replaced to prevent navigation loops

[huly-for-github]

Connected to Huly®: METAS-531