fix(auth): callback route redirect order + favicon.ico

- Move callback route exception check BEFORE auth redirect check
- This was preventing OIDC token exchange from ever happening
- Add favicon.ico to web root for browser tab icon

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/routing/app_router.dart

@@ -34,6 +34,11 @@ GoRouter appRouter(Ref ref) {
         return null;
       }
 
+      // Allow callback route through without auth check (must be checked FIRST!)
+      if (state.matchedLocation == AppRoutes.callback) {
+        return null;
+      }
+
       final isAuthenticated = authState.value?.isAuthenticated ?? false;
       final isLoginRoute = state.matchedLocation == AppRoutes.login;
 
@@ -47,11 +52,6 @@ GoRouter appRouter(Ref ref) {
         return AppRoutes.frontHall;
       }
 
-      // Allow callback route through without auth check
-      if (state.matchedLocation == AppRoutes.callback) {
-        return null;
-      }
-
       return null;
     },
     routes: [