🐛 fix(auth): stop entering a session for a server that was never logged into

[hub2rock]

Reported from the first TestFlight build: adding the very first server lands on the projects list without ever asking for credentials.

Cause

activeProfile stands for an authenticated session — RootView presents MainView as a full-screen cover the moment it turns non-nil. Two places set it with no token stored.

addProfile activated the profile whenever it was the first one. AddServerView does push the login screen right after, but the cover goes up first and buries it — which is why only the first server showed the bug; a second one logs in normally. selectServer already carries the guard against precisely this ("Selecting must not activate a profile with no token, or the app would drop into a session it can't authenticate"); it was simply missing here. Both login paths call setActiveProfile on success, so activating on add was redundant as well as harmful.

loadFromUserDefaults fell back to profiles.first when no active profile was stored. That brings the same bug back one relaunch later — and it quietly undid logging out. Logout and "switch server" both remove the stored key on purpose, so the next launch walked straight back into the session the user had just left; after a logout, with no token at all.

Fix

Activation now happens only where a token has been stored, and only an explicitly saved profile is restored on launch.

Tests

159 passing (2 new). Four existing tests encoded the old behaviour and now activate explicitly, the way the login flow does:

• addProfile appends without activating, even for the first profile — inverted
• profiles persist across instances — a saved-but-never-logged-into server no longer resumes a session
• an authenticated profile is restored on relaunch — new, guards the legitimate case
• clearing the active profile survives a relaunch — new, covers the logout regression

swiftformat --lint clean on both files. Note the repo is formatted with 0.61.1 (as CI pins) while 0.62.1 locally flags ~37 pre-existing files — unrelated drift, untouched here.

🤖 Generated with Claude Code