Restructure repo into five-package AFI architecture

Mizan is an Application Framework Interface (AFI) with five
independent packages:

  packages/
    mizan-ast/       Language layer (source → KDL schema)
    mizan-schema/    IR layer (KDL schema definition)
    mizan-rpc/       Protocol layer (client gen + server adapters)
      adapters/django/   ← was django/
      generator/         ← was react/src/generator/
    mizan-csr/       State layer (client state engine)
      adapters/react/    ← was react/
    mizan-ssr/       Rendering layer (server-side rendering)

Each package is independent. The adapter directories contain the
framework-specific implementations. Stub packages (ast, schema, ssr)
establish the structure for future work.

264 Django tests + 33 React tests pass from new locations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/mizan-csr/adapters/react/src/client/routing.tsx

@@ -0,0 +1,74 @@
+'use client'
+
+import { useEffect, type ReactNode } from 'react'
+import { useRouter } from './RouterContext'
+import { useAuth, useAuthRoutes } from './AuthContext'
+
+/**
+ * Route guard that only renders children if the user is authenticated.
+ * Redirects to login page if not authenticated.
+ */
+export function UserRoute({ children }: { children: ReactNode }) {
+    const router = useRouter()
+    const routes = useAuthRoutes()
+    const { isAuthenticated } = useAuth()
+
+    useEffect(() => {
+        if (!isAuthenticated) {
+            const searchParams = router.searchParams.toString()
+            const currentPath = searchParams
+                ? `${router.pathname}?${searchParams}`
+                : router.pathname
+            const next = encodeURIComponent(currentPath)
+            router.replace(`${routes.login}?next=${next}`)
+        }
+    }, [isAuthenticated, router, routes.login])
+
+    if (!isAuthenticated) return null
+    return children
+}
+
+/**
+ * Route guard that only renders children if the user is authenticated AND is staff.
+ * Redirects to login if not authenticated, or to authenticated route if not staff.
+ */
+export function StaffRoute({ children }: { children: ReactNode }) {
+    const router = useRouter()
+    const routes = useAuthRoutes()
+    const { isAuthenticated, isStaff } = useAuth()
+
+    useEffect(() => {
+        if (!isAuthenticated) {
+            const searchParams = router.searchParams.toString()
+            const currentPath = searchParams
+                ? `${router.pathname}?${searchParams}`
+                : router.pathname
+            const next = encodeURIComponent(currentPath)
+            router.replace(`${routes.login}?next=${next}`)
+        } else if (!isStaff) {
+            router.replace(routes.authenticated)
+        }
+    }, [isAuthenticated, isStaff, router, routes])
+
+    if (!isAuthenticated || !isStaff) return null
+    return children
+}
+
+/**
+ * Route guard that only renders children if the user is NOT authenticated.
+ * Redirects to authenticated route if already logged in.
+ */
+export function AnonymousRoute({ children }: { children: ReactNode }) {
+    const router = useRouter()
+    const routes = useAuthRoutes()
+    const { isAuthenticated } = useAuth()
+
+    useEffect(() => {
+        if (isAuthenticated) {
+            router.replace(routes.authenticated)
+        }
+    }, [isAuthenticated, routes.authenticated, router])
+
+    if (isAuthenticated) return null
+    return children
+}