docs(skills): guard both useAuth members in the auth-permissions example

.changeset/9350-auth-permissions-useauth-guard-both.md

@@ -0,0 +1,7 @@
+---
+---
+
+Guard both `isAuthenticated` and `user` in the `useAuth` example of
+`skills/objectui/guides/auth-permissions.md`, and say why beside it
+(objectui#9350). Published skills guidance only; no package is released by
+this change.

skills/objectui/guides/auth-permissions.md

@@ -35,14 +35,16 @@ function App() {
 
 ### useAuth hook
 
+Guard `user` on its own, not through `isAuthenticated`: in guest mode (`enabled: false`) and in preview mode, `AuthProvider` hardcodes `isAuthenticated` to `true` while `user` stays `null`, so a signed-in-looking context can still carry no user. The shipped `UserMenu` guards both members the same way.
+
 ```typescript
 import { useAuth } from '@object-ui/auth';
 
 function UserBadge() {
   const { user, isAuthenticated, isLoading, error, signOut } = useAuth();
 
   if (isLoading) return <Spinner />;
-  if (!isAuthenticated) return <LoginButton />;
+  if (!isAuthenticated || !user) return <LoginButton />;
 
   return (
     <div>