fix(auth): unblock the about page for unauthenticated visitors

The /about page (GeoLite2 attribution) was listed in proxy.ts
PUBLIC_PATHS but missed in AuthShell's client-side PUBLIC_PATHS, so
unauthenticated visitors bounced through /auth/login. Add /about to
the AuthShell list and treat it as a standalone public page (same
edge-to-edge render as /privacy).

Apply safe-area-inset-top on the privacy and about sticky headers so
iOS notch / Dynamic Island viewports don't overlap the brand row. Add
a default-closed Contents <details> TOC at the top of the privacy
policy and wrap every HealthKit identifier <code> with break-all so
long camelCase strings (heartRateVariabilitySDNN,
environmentalAudioExposure) wrap inside narrow viewports.

src/components/layout/auth-shell.tsx

@@ -11,7 +11,18 @@ import { BottomNav } from "./bottom-nav";
 import { SidebarNav } from "./sidebar-nav";
 import { TopBar } from "./top-bar";
 
-const PUBLIC_PATHS = ["/auth/login", "/auth/register", "/privacy"];
+// v1.4.27 MB6 — `/about` joins the public-path list so the GeoLite2
+// CC BY-SA 4.0 attribution stays reachable for unauthenticated
+// visitors. The `/about` route is already registered in `proxy.ts`
+// PUBLIC_PATHS; this constant gates the client-side auth shell, and
+// both lists must agree or the route round-trips through the
+// sign-in redirect.
+const PUBLIC_PATHS = [
+  "/auth/login",
+  "/auth/register",
+  "/privacy",
+  "/about",
+];
 
 export function AuthShell({ children }: { children: React.ReactNode }) {
   const { user, isAuthenticated, isLoading } = useAuth();
@@ -25,7 +36,10 @@ export function AuthShell({ children }: { children: React.ReactNode }) {
   // squash a 3000-word policy into a "login card" layout, so we let it
   // render edge-to-edge while still resolving as a public page for the
   // auth gate above.
-  const isStandalonePublicPage = pathname.startsWith("/privacy");
+  // v1.4.27 MB6 — `/about` follows the same shape (own header, own
+  // footer, full-width body), so it joins the standalone list.
+  const isStandalonePublicPage =
+    pathname.startsWith("/privacy") || pathname.startsWith("/about");
   const isAdminPage = pathname.startsWith("/admin");
   const isOnboardingPage = pathname === "/onboarding";
   const showUnlockNotifier = isAuthenticated && !isPublicPage && !!user?.id;