Add authentication guard for protected routes

[Wilfred007]

What

All routes under EmployerLayout are accessible without authentication. Add a route guard that redirects unauthenticated users to /login.

Why

Any user can access payroll, employee data, and admin pages by navigating directly to the URL. This is a security vulnerability.

Scope

In scope:

• Create ProtectedRoute wrapper component
• Apply to all routes except /login and /auth-callback
• Redirect with return URL for post-login redirect

Out of scope: Role-based access control, permission levels

Acceptance Criteria

• Unauthenticated users redirected to /login with return URL
• Authenticated users access protected routes normally
• Token expiry triggers redirect with toast notification
• No flash of protected content before redirect
• Return URL preserved for post-login navigation

Technical Context

• frontend/src/App.tsx — route definitions (lines 38-214)
• frontend/src/providers/ — auth context
• frontend/src/hooks/useWallet.ts — wallet connection state

[waterWang]

I have submitted a PR for this issue: #578