Hide hamburger menu until user is authenticated and onboarded

[davidortinau]

Description

The hamburger menu button in the upper left is visible on auth pages (login, register) before the user has logged in. Tapping it opens the full navigation sidebar, which should not be accessible to unauthenticated users.

Root cause: PageHeader.razor always renders the hamburger toggle on mobile (d-md-none). Auth pages like LoginPage.razor and RegisterPage.razor use PageHeader which exposes the nav.

Fix options:

1. Add an isAuthenticated parameter to PageHeader to conditionally hide the hamburger
2. Have auth pages not use PageHeader (use a simpler header instead)
3. Gate the offcanvas target in MainLayout (already gated, but PageHeader still renders the button)

Acceptance Criteria

• No hamburger icon visible on /auth, /auth/login, /auth/register pages
• Hamburger only appears after authentication + onboarding complete
• Mobile nav sidebar inaccessible to unauthenticated users

Labels

squad, squad:kaylee

[github-actions]

📋 Assigned to Kaylee (Full-stack Dev)

Issue: #97 — Hide hamburger menu until user is authenticated and onboarded

Kaylee will pick this up in the next Copilot session.

For Copilot coding agent: If enabled, this issue will be worked automatically.
Otherwise, start a Copilot session and say:
Kaylee, work on issue #97

[github-actions]

🏗️ Squad Triage — Zoe (Lead)

Issue: #97 — Hide hamburger menu until user is authenticated and onboarded
Assigned to: Wash (Backend Dev)
Reason: Issue relates to backend/API work

@copilot evaluation: 🔴 Not suitable — issue involves work outside the coding agent's capability profile.

Team roster:

• Zoe (Lead) → label: squad:zoe
• Kaylee (Full-stack Dev) → label: squad:kaylee
• Wash (Backend Dev) → label: squad:wash
• River (AI/Prompt Engineer) → label: squad:river
• Jayne (Tester) → label: squad:jayne
• Ralph (Work Monitor) → label: squad:ralph
• @copilot (Coding Agent) → label: squad:copilot

To reassign, remove the current squad:* label and add the correct one.

[davidortinau]

Investigated — no API errors found in structured logs or traces. Transient issues appear to have resolved.