Move allauth + auth UI to legacy/

allauth/ (44 files) is a django-allauth React UI — a separate concern
from the Mizan protocol. Moved to legacy/ pending extraction into a
standalone mizan-django-allauth package.

Also moved to legacy/:
- client/AuthContext.tsx — generic auth state from /me endpoint
- client/RouterContext.tsx — framework-agnostic router adapter
- client/routing.tsx — UserRoute/StaffRoute/AnonymousRoute guards
- client/nextjs.tsx — Next.js router adapter for auth

These are auth UI infrastructure, not Mizan protocol. The Mizan core
only needs JWT for auth header selection (jwt/ stays — MizanProvider
depends on useJWT() to decide between Bearer and session auth).

Cleaned up re-exports in client/react.ts and vitest aliases.

33 React tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

legacy/allauth/config.ts

@@ -0,0 +1,67 @@
+/**
+ * Configuration for the allauth library.
+ *
+ * This config serves two purposes:
+ * 1. Define the base path for Django-initiated routes (must match HEADLESS_FRONTEND_URLS)
+ * 2. Define where to navigate for various auth events (developer controls these)
+ *
+ * For JWT-based API calls, use mizan/jwt separately.
+ */
+
+export interface AllauthConfig {
+    /**
+     * Base path for Django-initiated routes (email verification, password reset, OAuth).
+     * This must match the base path configured in Django's HEADLESS_FRONTEND_URLS.
+     *
+     * Example: '/auth' means Django sends users to '/auth/verify-email/{key}'
+     */
+    basePath: string
+
+    /**
+     * Navigation targets for auth events.
+     * These are the URLs/paths the developer wants users sent to.
+     */
+    routes: {
+        /** Where to go after successful authentication */
+        authenticated: string
+        /** Where to go after logout */
+        logout: string
+        /** Where the login page is (for "Back to login" links) */
+        login: string
+        /** Where the signup page is (for "Create account" links) */
+        signup: string
+    }
+}
+
+export const defaultConfig: AllauthConfig = {
+    basePath: '/auth',
+    routes: {
+        authenticated: '/dashboard',
+        logout: '/',
+        login: '/login',
+        signup: '/signup',
+    },
+}
+
+/**
+ * Creates a config by merging provided options with defaults.
+ */
+export function createAllauthConfig(config: Partial<AllauthConfig>): AllauthConfig {
+    return {
+        basePath: config.basePath ?? defaultConfig.basePath,
+        routes: {
+            ...defaultConfig.routes,
+            ...config.routes,
+        },
+    }
+}
+
+/**
+ * Django-initiated flow paths (relative to basePath).
+ * These must match what's configured in Django's HEADLESS_FRONTEND_URLS.
+ */
+export const DjangoFlowPaths = {
+    VERIFY_EMAIL: '/verify-email',
+    RESET_PASSWORD: '/reset-password',
+    OAUTH_ERROR: '/oauth/error',
+} as const