Server-side authorization placement

An auth check under a Suspense boundary races the first flush

Streaming sends the sidebar and the skeleton before getSession() comes back, so a logged-out visitor sees the shape of a dashboard until the redirect lands. Closing that gap costs first-byte time on every protected route.