fix: enforce onboarding gate for applicants and observers

Applicants could bypass onboarding and land directly on the dashboard.
Added onboardingCompletedAt check + redirect to /onboarding in both
the applicant and observer layouts (jury/mentor already had this gate).
Also removed premature status ACTIVE on magic-link first login — now
only completeOnboarding sets ACTIVE.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/app/(applicant)/layout.tsx

@@ -1,5 +1,6 @@
 import { redirect } from 'next/navigation'
-import { auth } from '@/lib/auth'
+import { prisma } from '@/lib/prisma'
+import { requireRole } from '@/lib/auth-redirect'
 import { ApplicantNav } from '@/components/layouts/applicant-nav'
 
 export const dynamic = 'force-dynamic'
@@ -9,14 +10,20 @@ export default async function ApplicantLayout({
 }: {
   children: React.ReactNode
 }) {
-  const session = await auth()
+  const session = await requireRole('APPLICANT')
 
-  if (!session?.user) {
+  // Check if user has completed onboarding
+  const user = await prisma.user.findUnique({
+    where: { id: session.user.id },
+    select: { onboardingCompletedAt: true },
+  })
+
+  if (!user) {
     redirect('/login')
   }
 
-  if (session.user.role !== 'APPLICANT') {
-    redirect('/login')
+  if (!user.onboardingCompletedAt) {
+    redirect('/onboarding')
   }
 
   return (