feat: add ProtectedRoute guard for employer routes (Fixes #467)

[waterWang]

Summary

Add a ProtectedRoute wrapper component that guards all employer-facing routes behind authentication. Unauthenticated users are redirected to /login with a redirect query param, so they return to the originally requested page after a successful login.

Changes

1. New ProtectedRoute.tsx — Route guard that checks for payd_auth_token in localStorage. If missing, redirects to /login?redirect=<original_path>.

2. Updated App.tsx — Wrapped all EmployerLayout routes inside <Route element={<ProtectedRoute />}>. Public routes (/login, /auth-callback) remain outside the guard.

3. Updated Login.tsx — Reads the redirect query param and saves it to localStorage (payd_auth_redirect) so the post-login redirect target is preserved across the OAuth redirect chain.

4. Updated AuthCallback.tsx — After storing the auth token, reads the saved redirect path from localStorage and navigates there (fallback to /). Uses replace: true to avoid the callback page lingering in browser history.

Scope

• Create ProtectedRoute wrapper component
• Apply to all routes except /login and /auth-callback
• Redirect with return URL for post-login redirect

Closes #467