fix: allowlist guard on setup pages + login UX (#11)

## Summary

- `setupPage` wrapper now checks `isAllowed()` — routes like
/setup/metadata, /setup/fund, /setup/join no longer bypass the allowlist
- Login early return renders invite-only screen instead of falling
through to sign-in form
- Disconnect uses `navigate("/login", { force: true })` to re-render on
same hash
- Version bump 0.2.5 → 0.2.6

## Test plan

- [x] CI passes (test + build)

Author: AquiGorka

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonlight-protocol/provider-console",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "license": "MIT",
   "tasks": {
     "dev": "deno run --allow-all --allow-env --watch src/server.ts",

src/views/login.ts

@@ -7,7 +7,13 @@ import { isAllowed, API_BASE_URL } from "../lib/config.ts";
 
 export function loginView(): HTMLElement {
   const existingAddr = getConnectedAddress();
-  if (isAuthenticated() && isMasterSeedReady() && (!existingAddr || isAllowed(existingAddr))) {
+  if (isAuthenticated() && isMasterSeedReady()) {
+    if (existingAddr && !isAllowed(existingAddr)) {
+      const container = document.createElement("div");
+      container.className = "login-container";
+      renderInviteOnly(container, existingAddr);
+      return container;
+    }
     navigate("/");
     return document.createElement("div");
   }
@@ -186,6 +192,6 @@ function renderInviteOnly(container: HTMLElement, address: string): void {
     e.preventDefault();
     clearSession();
     clearPlatformAuth();
-    navigate("/login");
+    navigate("/login", { force: true });
   });
 }

src/views/setup/layout.ts

@@ -2,7 +2,8 @@
  * Shared setup layout with progress stepper.
  */
 import { isAuthenticated } from "../../lib/api.ts";
-import { isMasterSeedReady } from "../../lib/wallet.ts";
+import { isMasterSeedReady, getConnectedAddress } from "../../lib/wallet.ts";
+import { isAllowed } from "../../lib/config.ts";
 import { navigate } from "../../lib/router.ts";
 import { renderNav } from "../../components/nav.ts";
 import { SETUP_STEPS, type SetupStepId } from "../../lib/setup.ts";
@@ -12,7 +13,8 @@ export function setupPage(
   renderStep: () => HTMLElement | Promise<HTMLElement>,
 ): () => Promise<HTMLElement> {
   return async () => {
-    if (!isAuthenticated() || !isMasterSeedReady()) {
+    const addr = getConnectedAddress();
+    if (!isAuthenticated() || !isMasterSeedReady() || (addr && !isAllowed(addr))) {
       navigate("/login");
       return document.createElement("div");
     }