Firebase Auth — Dummy Google Sign-In only #69

📋 Description

Auth placeholder. The landing CTAs call a dummy signIn() and go to /dashboard.
userStore holds only isAuthenticated: boolean, kept in memory. No token, no SDK.
Firebase replaces the body of signIn() / signOut() in a later sprint, once billing is active.

✅ Acceptance Criteria

Behaviour

• Every landing CTA ("Commencer gratuitement", the navbar "Se connecter", the CTA section) is a <button> that calls signIn() and then navigates to /dashboard.
• /dashboard is wrapped in RequireAuth. Unauthenticated users are redirected to /.
• The dashboard logout button calls signOut() and returns to /.
• Unknown routes (*) redirect to /.
• A page refresh clears the session (in-memory only, no storage).

Store

• src/store/userStore.ts (Zustand) exposes isAuthenticated, signIn() and signOut(), and nothing else.

Removal

• Delete the /login, /signup and /forgot-password routes and pages.
• Delete useAuthForm, authValidation, authMessages, AuthField, AuthLayout, dummyAuth and authSession.
• Delete the auth tests and the unused auth-* CSS.
• Remove the localStorage session.

Copy

• Dashboard text no longer mentions backend auth (per ADR-002, auth is Firebase).

Tests (CI requires a coverage increase)

• Vitest: the store (signIn / signOut), RequireAuth (redirect vs render), the landing CTA, and dashboard logout.
• Playwright: rewrite smoke.spec.ts as "click the CTA, land on /dashboard"; "visit /dashboard directly, land on /"; "unknown route, land on /".
• Simplify e2e/fixtures/auth.ts (no form filling).

Docs

• Add a Notion "Documentation Technique" entry (via notion_create_doc).
• Add a short ADR-002 note: the Firebase swap point is userStore.signIn / signOut.

🔗 Prerequisite Issues

Replaces #21 (closed: email/password no longer matches the Firebase / Google Sign-In decision).