fix: resolve refresh routing and auth redirect issues on protected routes (#363)

[KRUSHAL2956]

📌 Description

While testing the live deployment, I noticed that refreshing protected routes like /dashboard was causing the app to show a Not Found page or sometimes redirect users back to the login page unexpectedly.

After debugging the routing and auth flow, I found that the issue was mainly caused by SPA routing behavior on deployment and auth initialization happening asynchronously during refresh.

This PR improves route handling and stabilizes auth restoration so protected pages work correctly after refresh and direct navigation.

---

🔗 Related Issue

Closes #363

---

🛠 Changes Made

• Switched from BrowserRouter to HashRouter for stable SPA routing on deployment
• Added isInitialized handling in AuthContext
• Updated ProtectedRoutes to wait for auth initialization before redirecting
• Added loading state during auth verification
• Added fallback NotFound route for invalid paths
• Improved backend empty-state handling by returning empty arrays instead of 400 responses
• Updated CORS configuration using environment variables
• Added _redirects support for deployment routing

---

📸 Screen Recording

Screencast.from.2026-05-16.23-54-04.mp4

---

✅ Checklist

• Code runs locally
• Tested on live deployment
• Followed project structure
• No console errors
• Properly tested changes
• Linked the issue

---

🚀 Notes for Reviewers

Mainly focused on fixing refresh-related routing failures and preventing auth redirect race conditions during initialization. Also verified protected routes and invalid route handling after deployment.

[KRUSHAL2956]

Resolved merge conflicts and re-tested the refresh/auth flow after syncing with the latest main branch 👍