feat: optimize dashboard bootstrap rendering

[k002bill2]

Summary

• Add authenticated GET /api/bootstrap aggregation for user, project, model, and menu data.
• Hydrate existing Zustand stores from the bootstrap response to reduce initial request waterfall and duplicate requests.
• Split public authentication route loading and harden stale-session, menu fallback, and filesystem ACL behavior.
• Add backend and frontend regression coverage plus the implementation plan.

Validation

• cd src/dashboard && npm run type-check
• cd src/dashboard && npm run lint
• cd src/dashboard && npm run test:run
• cd src/dashboard && npm run build
• cd src/backend && uv run pytest ../../tests/backend -q --tb=short — 1,980 passed, 32 skipped
• staged diff check and literal-secret scan
• commit hooks: Ruff, TypeScript, ESLint

Security note

• Local security-hardening tests pass.
• The final independent Orca Security review could not return a structured verdict because its terminal ended with host_status_unavailable; this is recorded as unknown rather than treated as a pass.

Merge scope

This PR contains the reviewed changes from commit 1e29337dfa479b7e872690a97c0a6fcef10e6ffb.