fix(auth): move loading check after hooks to fix Rules of Hooks violation

Early return before useCallback/useMemo caused React error #310
(different hook count between renders). Loading spinner now renders
after all hooks are called unconditionally.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/core/auth/auth-provider.tsx

@@ -30,16 +30,7 @@ interface AuthProviderProps {
 function AuthProviderInner({ children }: AuthProviderProps) {
   const { data: session, status } = useSession();
 
-  // Show loading spinner while session is being validated
-  if (status === "loading") {
-    return (
-      <div className="flex h-screen items-center justify-center">
-        <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
-      </div>
-    );
-  }
-
-  // Use session user if available, otherwise fallback to stub in dev mode
+  // Derive user from session (all hooks must be called unconditionally)
   const user: User | null = session?.user
     ? {
         id: (session.user as any).id || "unknown",
@@ -79,6 +70,15 @@ function AuthProviderInner({ children }: AuthProviderProps) {
     [user, hasRole, canAccessModule],
   );
 
+  // Show loading spinner while session is being validated (after all hooks)
+  if (status === "loading") {
+    return (
+      <div className="flex h-screen items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
+      </div>
+    );
+  }
+
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
 }