Frontend routes — Elixpo Login and role-aware onboarding

[Circuit-Overtime]

Parent: #6

Build authentication transitions and first-run onboarding around Elixpo Accounts.

Routes

• /login — Elixpo Login handoff
• /auth/callback — callback progress and failures
• /onboarding — role-aware entry point
• /onboarding/host — host organization setup
• /onboarding/contributor — contributor profile and interests

Requirements

• Return-path preservation
• Expired, denied, malformed, and retryable callback states
• Invitation-aware onboarding for hosts, admins, mentors, and ambassadors
• Clear separation between authentication and GitHub connection

Acceptance criteria

• Redirect and error states are keyboard and screen-reader accessible
• No credentials or tokens appear in client-visible UI
• Backend identity implementation is excluded