feat(kit): defer authenticated offline runtime

[rdlabo]

Summary

• add an opt-in background resume mode for phased authenticated access
• let route-scoped offline consumers initialize local storage first and start network/sync infrastructure after content readiness
• preserve blocking initialization by default and keep deferred session preparation explicitly opt-in
• redirect away from protected routes when a background resume receives an explicit 401/403

Compatibility

This is additive. Existing consumers retain blocking route activation and full runtime initialization. Package versions are intentionally unchanged. No migration is required.

Safety

Identity leases are rechecked across the readiness boundary. Stale background failures cannot clear or redirect a newer session. Classified transport failures keep verified access, while explicit authentication denial revokes access and redirects to the configured unauthorized route.

Verification

• npm run lint
• npx ng test kit --watch=false (53 files, 975 tests)
• npm run prebuild:kit
• consumer validation in SeatKeep: app/site lint, 118 app test files / 871 tests, site test, and CI production build
• git diff --check

Performance scope

The change removes remote runtime discovery and synchronization from the opt-in authenticated route critical path. It does not claim a JavaScript bundle-size reduction.