feat(auth): add cold-start token verification with loading state to app layout

Move token verification from root layout SessionGate to (app) group layout,
enabling cold-start verification without blocking public pages (privacy/terms).
Show ActivityIndicator while verification is in progress, then redirect to
login if unverified.

BREAKING CHANGE: Authentication flow changed - token verification now occurs
in the (app) layout group instead of root layout SessionGate wrapper.

app.json

@@ -2,7 +2,7 @@
   "expo": {
     "name": "威友",
     "slug": "qojo",
-    "version": "0.0.2",
+    "version": "1.0.0",
     "orientation": "default",
     "icon": "./assets/icon.png",
     "userInterfaceStyle": "automatic",