GoRouter Auth Redirect

The single redirect function in goRouter performs the entire auth funnel: not-logged-in → /login; logged-in but profileSetupComplete=false → /onboarding_register(_seller); ToS not accepted → /terms; seller-only routes hidden when !hasSellerRole. It is the de-facto auth state machine.

1. On every navigation, fetches isLoggedIn, isProfileSetupComplete, hasSellerRole, isPendingSellerRegistration, ToS status.
2. Splash route is always allowed through (initial loading screen).
3. Unauthenticated + auth route → pass; unauthenticated + anything else → /login.
4. Authenticated + incomplete profile → /onboarding_register or /onboarding_register_seller (based on pending flag).
5. Authenticated + complete + ToS pending → /terms; if already there → pass.
6. Authenticated + on auth/onboarding route → bounce to /home.
7. Authenticated + seller-only path + !hasSellerRole → /home.

• _hasConsentedToS is a module-level memoization to stop the redirect spamming /tos/latest on every frame while the user is parked on the ToS screen — without it, the router enters a backend-pinging loop.
• isPendingSellerRegistration picks which onboarding wizard to route to, branching what is otherwise a uniform onboarding flow.
• isEditPrestationRoute uses a regex on /prestation/:id/edit because GoRouter does not expose the route name during the redirect phase.

• lib/src/core/routing/app_router.dart:76 // _checkIsLoggedIn
• lib/src/core/routing/app_router.dart:94 // _verifyTosConsent (memoized)
• lib/src/core/routing/app_router.dart:131 // GoRouter.redirect
• lib/src/core/routing/routes.dart // AppRoute enum

Every redirect awaits SharedPreferences reads serially — adding more checks here will slow first-frame navigation. The pattern is to push new gates into _verifyTosConsent-style memoized helpers.