feat: allow guest dashboard browsing and authenticate only for interactive actions

[Deyanju23]

Closes #389

Summary

Introduces a guest browsing experience that allows unauthenticated users to explore the website and view public dashboards without signing in. Authentication is required only when users attempt interactive actions such as saving, creating, exporting, or modifying data.

Changes

Guest Mode

• Enabled guest access to the homepage and all public dashboard routes.
• Updated routing to remove mandatory authentication from dashboard browsing pages.
• Dashboard metrics, charts, and visualizations render using public or demo data when a user is not authenticated.
• Added an optional, non-intrusive banner encouraging users to sign in to save their work.

Authentication Gates

Interactive actions now require authentication.

Protected actions include (where applicable):

• Save
• Create
• Export
• Submit
• Configure
• Comment
• Private settings
• Any other state-changing operation

When an unauthenticated user attempts one of these actions:

• the action is intercepted
• an authentication modal (or project-standard login flow) is displayed
• the current page and pending action are preserved when possible
• after successful authentication, the user is returned to the same dashboard and the pending action resumes if supported

State Management

Implemented a reusable authentication guard/interceptor that:

• checks authentication before protected actions
• stores the current route and pending action
• restores navigation after login
• minimizes duplicate authentication logic across components

Backend

Updated public read endpoints so dashboard GET requests can be accessed without authentication while preserving authorization for all protected operations.

Tests

Added/updated tests covering:

• guest access to dashboard routes
• public dashboard rendering
• authentication prompt on protected actions
• redirect back to original dashboard after login
• pending action restoration (where supported)
• authenticated users continue to function normally
• protected API endpoints remain secured
• public GET endpoints work without authentication

Documentation

Updated documentation describing:

• guest browsing behavior
• authentication gates
• public vs protected endpoints
• redirect-after-login flow

Security

• Read-only dashboard data remains public.
• All state-changing operations continue to require authentication.
• Existing authorization rules remain intact.
• No privilege escalation introduced.

Testing

Executed:

npm test
npm run build

Notes

• No breaking API changes.
• Existing authenticated workflows continue to function unchanged.
• Authentication is requested only when necessary, improving onboarding and user experience.

[vercel]

@Deyanju23 is attempting to deploy a commit to the sheriffamina1-9497's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Deyanju23 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[amina69]

@Deyanju23 ci pipeline failed, there is a lint error

[Deyanju23]

@Deyanju23 ci pipeline failed, there is a lint error

i've resolved both issues, kindly review and merge.