SPA tests: Login + ProtectedRoute auth gating (+ renderWithProviders helper) #116

Follow-up to #110/#115 (targeted frontend-coverage push). Add a shared renderWithProviders test helper (MemoryRouter + AuthProvider + mocked API + role seeding) and use it to cover the auth/routing gate.

Helper

• web/src/test/renderWithProviders.tsx — wraps a component in MemoryRouter (configurable initialEntries) + AuthProvider, seeds a role via the existing setStoredToken (jwt.ts), returns RTL's render result. Reused by all screen tests.

Cover

• ProtectedRoute — unauthenticated → redirects to /login; authenticated → renders children.
• Login — submit calls login, navigates on success; shows the API error on failure; disables submit while pending.

Part of #105, epic #14.