fix: allow unauthenticated access to /items/* with setup context

Items accessed via ?setup= or ?share= query params are now treated as
public routes, preventing the auth redirect to /login.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/client/routes/__root.tsx

@@ -126,13 +126,16 @@ function RootLayout() {
 	const currentThreadId = threadMatch ? Number(threadMatch.threadId) : null;
 
 	// Allow public routes through without auth
+	const searchParams = new URLSearchParams(location.search);
 	const isPublicRoute =
 		location.pathname === "/" ||
 		location.pathname.startsWith("/users/") ||
 		location.pathname.startsWith("/global-items") ||
 		location.pathname === "/setups" ||
 		location.pathname.startsWith("/setups/") ||
-		location.pathname === "/login";
+		location.pathname === "/login" ||
+		(location.pathname.startsWith("/items/") &&
+			(searchParams.has("setup") || searchParams.has("share")));
 
 	// FAB visibility: show on all authenticated, non-public routes
 	const isSetupsPage = !!matchRoute({ to: "/setups", fuzzy: true });