* ♻️ refactor(auth): make the auth shell safe to prerender
Three changes, all behaviour-preserving for the current client-rendered
auth SPA, that a prerendered copy of the same pages needs:
- `enableBusinessFeatures` is a build-time constant, not deployment state.
`AuthServerConfigProvider` now reads it from `@lobechat/business-const`
instead of the injected server config, so a render that has not received
that config yet still resolves the right SSO provider source.
- The terms checkbox and the "last used" provider both seeded `useState`
from `localStorage` during render. A returning user's stored value makes
the first render depend on the browser, which cannot be prerendered; they
now start empty and fill in from an effect.
- `LobeAnalyticsProviderWrapper` accepts the analytics config as a prop and
guards its `window` read, so it can render outside a browser.
Also drops the `@/features/AuthShell` barrel from the `src/features/Auth`
importers: the barrel re-exports `AuthShell`, which pulls `AuthLocale` and
the full en-US dictionary into every consumer's graph.
* ✨ feat(auth): split the auth surface into a prerendered micro app
`apps/auth` renders the sign-in flow ahead of time instead of shipping an
empty `#root`. React Router framework mode with `ssr: false` + `prerender`,
so the worker carries no React at all — 7KB, it picks one prerendered
document by locale and swaps in the deployment's config.
- 18 locales x 4 routes = 72 documents, plus a SPA fallback for the routes
that take params. One build pass per locale writes the same canonical
paths; the non-default passes are folded into `build/client/__i18n/`.
Passes are independent, so they run 6 at a time (3m05s -> 44s).
- Each document inlines only its own locale's dictionary; the rest load on
demand for the language switcher, which keeps them off the first-load
path entirely.
- `/webapi/auth/spa-config` is a new public endpoint the worker reads to
fill `window.__SERVER_CONFIG__`. It carries only the six fields the auth
pages actually read; a failed lookup leaves the placeholder and the page
still renders.
- Per-route SEO: real localized titles, and `noindex, nofollow` on every
transactional page — only /signin and /signup stay indexable, with a
canonical URL.
The existing Next.js `/spa-auth` route is untouched, so self-hosted and
Docker deployments keep serving the client-rendered SPA. This app builds
and deploys from lobehub-cloud, which overlays `@/business/*`.
* 🐛 fix(auth): restore feature flags and track the prerender lib
Innei