fix(06): make AppNav persistent across routes so Lists keeps the nav

- Lift AppNav from CalendarShell to App.tsx as a sibling of <Routes>
- App.tsx fetches /api/me (same query key as CalendarShell — deduplicated by TanStack Query)
- App.tsx provides the outer layout (phone: column, desktop: row) with AppNav always rendered
- CalendarShell simplified: no longer manages AppNav, outer flex layout stays in App.tsx
- AuthSplash gains overlay prop (position:fixed inset:0 z-index:999) so it covers AppNav when needed
- CalendarShell uses AuthSplash with overlay=true so auth splashes cover full viewport
- Remove onOpenSettings prop from CalendarShell (wired directly in App.tsx to SettingsSheet)
- Desktop sidebar nav (FamilySync brand, Calendar/Lists links) now persists on /lists route

apps/pwa/src/components/AuthSplash.tsx

@@ -38,12 +38,20 @@ export interface AuthSplashProps {
    * Defaults to "Taking you to the sign-in page…" (cold-load copy per UI-SPEC §Surface 1).
    */
   body?: string
+  /**
+   * When true, renders with position:fixed inset:0 z-index:999 so the splash
+   * covers the entire viewport including the persistent AppNav (FIX 3).
+   * Use this when CalendarShell (a child of the app shell) needs to show an
+   * auth interstitial that hides the nav chrome.
+   */
+  overlay?: boolean
 }
 
 export function AuthSplash({
   state,
   heading = 'Signing you in',
   body = 'Taking you to the sign-in page…',
+  overlay = false,
 }: AuthSplashProps) {
   const isDeadEnd = state === 'dead-end'
   const showSpinner = !isDeadEnd
@@ -53,7 +61,9 @@ export function AuthSplash({
       role="status"
       aria-label="Signing you in"
       style={{
-        height: '100dvh',
+        ...(overlay
+          ? { position: 'fixed', inset: 0, zIndex: 999 }
+          : { height: '100dvh' }),
         display: 'flex',
         flexDirection: 'column',
         alignItems: 'center',