[ImJanindu]

📌 Summary of Changes

This PR resolves several UI/UX glitches, enhances route protection and authorization handling, refactors verification email delivery, and cleans up code quality across authentication workflows.

1. 🎨 Header & Navigation Fixes

• Theme Toggle Flash: Replaced the delayed mounted-state check with zero-layout-shift Tailwind CSS dark mode variants (hidden dark:block and block dark:hidden).
• Register Button & Duplicate Link Glitch: Removed redundant /register from NAV_LINKS so it acts exclusively as the primary CTA button without duplication or hydration pop-in.

2. 🛡️ Route Protection & Session Validation

• Centralized Route Guard (guard.ts): Added reusable layout-level server-side access control for protected role routes (/donor/*, /hospital/*, /admin/*).
• Unauthorized Access Handling:
  • Unauthenticated users manually accessing protected routes are redirected to /login with an informative toast: "Please login first to access this page."
  • Authenticated users attempting to view unauthorized role dashboards are redirected to a new custom 403 Not Authorized page (/unauthorized) mirroring the app's error design system.

Why guard.ts over proxy.ts/middleware.ts:

• Defense-in-depth & Data Protection: Next.js best practices recommend verifying authorization directly at the layout/data-access layer rather than trusting proxy/middleware alone to prevent unauthorized RSC payload leaks during prefetching.
• Full Node.js & DB Support: Avoids Edge runtime constraints, allowing direct access to Better Auth sessions, Mongoose models, and real-time user status checks.

In line with Next.js security guidelines, validating auth at the layout and Data-Access Layer ensures that sensitive Server Component payloads are never leaked during prefetching and avoids Edge runtime constraints when validating user roles against the database.

3. 📧 Email Verification & Workflow Improvements

• Pulse Logo in Email: Inlined the high-resolution Pulse logo as a Base64 data URI in verification emails, preventing broken images and eliminating unwanted email attachments in Gmail/Outlook.
• Streamlined Verification Flow: Removed automatic auto-login on email verification; users are redirected back to the login screen with clear success/failure feedback prompts to log in securely.

4. 🚪 Logout & Login Button State Fix

• Stuck Loading Loop: Resolved an issue where the login submit button remained stuck in "Logging in..." after logging out by implementing proper router cache busting (router.refresh()) and flag-based navigation on logout.
• Prevented false "Please login first" warning toasts from appearing on intentional user logouts.

---

✨ Code Quality & Best Practices

• Zero ESLint Warnings: Code formatted and passes eslint cleanly (0 errors, 0 warnings).
• Strict Type Safety: Passed full tsc --noEmit type checking.
• Modern Next.js Standards: Adheres to Next.js App Router best practices, including asynchronous headers() access and Server Component layout boundaries.