feat(welcome): landing lightbox, prod-served screenshots & session-end UX

- Serve real files at the SPA root (e.g. /welcome/*.png, favicon) from the built app — the
  landing screenshots were only ever shown by the Vite dev server, never in production.
- Add the Channel-manager screenshot; the two secondary previews are smaller thumbnails that
  open in a custom full-size lightbox (fit-to-viewport, Esc/backdrop/✕ to close).
- Drop a suspended/deleted user to the login page on the next 401 (and poll the session only
  while signed in, so the public login page no longer flickers); 'suspended' and 'account
  deleted' confirmation banners; strip redirect query params for a clean address bar.

frontend/src/i18n/locales/en/welcome.json

@@ -68,6 +68,8 @@
     "verifyOk": "Email confirmed. Once an admin approves your account, you can sign in.",
     "verifyInvalid": "That verification link is invalid or has expired.",
     "accessRequested": "Thanks — we recorded your request. An admin will review it.",
-    "accessDenied": "That account isn't approved for this instance yet — register below or ask the admin for access."
+    "accessDenied": "That account isn't approved for this instance yet — register below or ask the admin for access.",
+    "suspended": "This account has been suspended and can't sign in. If you think this is a mistake, contact the operator (check your email for details).",
+    "deleted": "Your account and all its data were permanently deleted. We've emailed you a confirmation."
   }
 }