Protected app shell.

The authenticated-app frame: sidebar + topbar + content slot. Permission-driven nav, responsive dropdown↔sheet swap, global dialog mount point. Every signed-in route uses this.