fix(auth): redirect active sessions from /login

/api/auth/status did not expose whether the auth cookie corresponds to a
valid dashboard session, so /login could only detect "auth disabled"
(requireLogin === false) and not "already logged in". Add authenticated
to the status response and redirect from /login when it's true.

src/app/api/auth/status/route.js

@@ -24,6 +24,7 @@ export async function GET() {
       hasPassword: !!settings.password,
       displayName,
       loginMethod,
+      authenticated: !!session,
       oidcName: oidcName || null,
       oidcEmail: oidcEmail || null,
       oidcLogin: !!session?.oidc,
@@ -37,6 +38,7 @@ export async function GET() {
       hasPassword: false,
       displayName: "Password user",
       loginMethod: "Password",
+      authenticated: false,
       oidcName: null,
       oidcEmail: null,
       oidcLogin: false,