Add admin CLI command and auth guard, use oRPC client

CLI changes:
- Use official oRPC client instead of manual HTTP requests
- Add admin complete-login command for dev workflow
- Remove type assertions, use proper ContractRouterClient typing
- Add @orpc/client and @orpc/contract dependencies

API changes:
- Use oRPC cookie helpers from @orpc/server/helpers
- Improve admin complete-login error messages (expired, already completed)

Dashboard changes:
- Add AuthGuard component to redirect unauthenticated users to /auth/login
- Update confirm page with correct CLI command and copy button
- Remove duplicate auth redirect from dashboard layout

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cli/src/routes/user/confirm-email.ts

@@ -11,9 +11,9 @@ async function confirmEmail(
   flags: ConfirmEmailFlags,
 ): Promise<void> {
   try {
-    const client = await createApiClient();
+    const api = await createApiClient();
 
-    await client.call("admin.users.confirmEmail", {
+    await api.admin.users.confirmEmail({
       email: flags.email,
     });
 

apps/cli/src/routes/user/create.ts

@@ -2,6 +2,18 @@ import type { LocalContext } from "../../context.js";
 import { buildCommand } from "@stricli/core";
 import { createApiClient } from "../../utils/api-client.js";
 
+type OrgRole = "owner" | "admin" | "member";
+
+const validRoles: OrgRole[] = ["owner", "admin", "member"];
+
+function parseRole(role: string | undefined): OrgRole | undefined {
+  if (!role) return undefined;
+  if (validRoles.includes(role as OrgRole)) {
+    return role as OrgRole;
+  }
+  throw new Error(`Invalid role: ${role}. Must be one of: ${validRoles.join(", ")}`);
+}
+
 interface CreateUserFlags {
   email: string;
   name?: string;
@@ -14,13 +26,14 @@ async function create(
   flags: CreateUserFlags,
 ): Promise<void> {
   try {
-    const client = await createApiClient();
+    const orgRole = parseRole(flags.role);
+    const api = await createApiClient();
 
-    await client.call("admin.users.create", {
+    await api.admin.users.create({
       email: flags.email,
       name: flags.name,
       orgSlug: flags.org,
-      orgRole: flags.role,
+      orgRole,
     });
 
     console.log(`Created user: ${flags.email}`);