feat(l1): role-based sidebar nav + L1 post-login redirect

L1 users see a focused sidebar with only their L1 surfaces (Workspace,
Tickets, My Drafts, Guides, Account). Engineers with can_cover_l1
(plus owners/super_admins) get an appended "L1 Workspace" entry in
their existing sidebar. ProtectedRoute redirects L1 users from / to /l1
on login.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/components/layout/ProtectedRoute.tsx

@@ -43,6 +43,12 @@ export function ProtectedRoute({ requiredRole, children }: ProtectedRouteProps)
     }
   }
 
+  // L1 users landing on / (e.g. post-login) get redirected to their workspace.
+  // Does not fire when already on /l1 or any other path, preventing loops.
+  if (effectiveRole === 'l1_tech' && location.pathname === '/') {
+    return <Navigate to="/l1" replace />
+  }
+
   return <>{children}</>
 }