fix(leads): disable sign-in submit until exhibit loads; add licensed-user auth tests

Prevents silent no-op when user clicks submit before lq__exhibit_obj is ready
(exhibit not yet written to Dexie). Button now shows 'Loading...' spinner while
the exhibit record is resolving, eliminating the two-tap workaround needed on
first page load.

Also adds 7 Playwright tests for licensed user sign-in (leads_licensed_signin.test.ts)
covering success path, wrong credentials, email/identity tagging on captured leads,
identity isolation between staff members, and returning-session bypass.

Helpers: attach_leads_routes/setup_leads_test_page now accept exhibit_overrides
(e.g. license_li_json) to inject licensed users into mocked API responses.
seed_leads_loc import added to leads_auth.test.ts multi-exhibit test.

Total leads test coverage: 29 tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/events/[event_id]/(leads)/leads/exhibit/[exhibit_id]/ae_comp__exhibit_signin.svelte

@@ -213,8 +213,13 @@ function complete_signin(key: string, type: string) {
         <button
             type="submit"
             class="btn btn-lg preset-filled-primary shadow-primary-500/20 group w-full font-bold shadow-lg"
-            disabled={status === 'submitting'}>
-            {#if status === 'submitting'}
+            disabled={status === 'submitting' || !$lq__exhibit_obj}>
+            {#if !$lq__exhibit_obj}
+                <!-- Exhibit record still loading from Dexie/API — block submission
+                     until it's ready so handle_signin() doesn't return silently. -->
+                <LoaderCircle size="1.5em" class="mr-2 animate-spin" />
+                Loading...
+            {:else if status === 'submitting'}
                 <LoaderCircle size="1.5em" class="mr-2 animate-spin" />
                 Signing In...
             {:else if status === 'success'}