fix: prevent LoginPrompt flash on page refresh with stored token

Add additional condition to check for the intermediate auth state where
authSource exists but token hasn't been fetched yet. This prevents the
LoginPrompt from briefly flashing when the page is refreshed and the user
already has a stored access token.

Changes the condition from just `isAuthLoading` to also cover the gap
before the useAuth effect starts fetching the token, displaying the
loading state instead of the login prompt.

web/src/App.tsx

@@ -154,8 +154,8 @@ export function App() {
         return <LoginPrompt onLogin={setAccessToken} />
     }
 
-    // Authenticating
-    if (isAuthLoading) {
+    // Authenticating (also covers the gap before useAuth effect starts)
+    if (isAuthLoading || (authSource && !token && !authError)) {
         return (
             <div className="h-full flex items-center justify-center p-4">
                 <LoadingState label="Authorizing…" className="text-sm" />