fix(login): defer decorative doodles

[Yevanchen]

Summary

• Defers the generated login doodle artwork behind a post-mount lazy boundary.
• Keeps the auth card and topbar in the initial login route chunk while moving decorative doodle art into its own deferred chunk.

Why

• The doodle art is decorative and hidden below the lg breakpoint, but it was eagerly included in the public /login route chunk.

Closes YEF-900

Verification

• Commands:
  • bun run --filter @mosoo/web build
  • bun run --filter @mosoo/web tc
  • bun run --filter @mosoo/web test
  • bun run --filter @mosoo/web lint
• Manual steps:
  • Built production apps/web/dist and measured the React Router route set with a local SPA static server, immediate GraphQL stubs for viewer/app data, headless Chromium, 1280x720 viewport, and 3 load-event samples per route.
  • /login route chunk: 51.99 kB raw / 21.58 kB gzip -> 8.68 kB raw / 3.55 kB gzip; deferred doodles chunk: 43.90 kB raw / 17.86 kB gzip.
  • Post-change all 27 measured routes loaded under 50 ms; slowest max was /login at 21.01 ms.
• Not run:
  • just check (focused web-only change; ran package build, type-check, tests, and lint instead).

Impact

• User/API/contract changes: no API or contract changes; public login artwork appears after the auth UI mounts.
• Generated files / GraphQL / DB / lockfile: none.
• Env or config changes: none.
• Risk and rollback: low; rollback reverts the lazy boundary if delayed decorative art is not desired.

Review

• Closest review areas: apps/web/src/routes/login/login.route.tsx.
• Known trade-offs: the decorative doodle artwork can appear slightly later than the auth card on first load.

[Yevanchen]

CI triage update:

• Repository check failed earlier because oven-sh/setup-bun@v2 hit repeated HTTP 504 while downloading Bun canary. I reran run 30108582372 and Repository check is now passing.
• The remaining non-green item is CodeQL / Analyze (javascript-typescript). GitHub canceled it because the hosted runner was not acquired after multiple attempts. The Actions API rejects rerunning that dynamic CodeQL run with HTTP 403, so there is no branch code fix to apply for that status.

I did not merge the PR.