navi: read auth login/logout URLs from /api/config (extraction #2 PR-C)

Panel.jsx now reads the login/logout URLs from the deployment config
(cfg.auth.login_url / cfg.auth.logout_url) instead of hardcoding them, with
the current home-profile literals kept as fallback. This completes the
extraction #2 trio:
  - PR-A (recon #6):   adds the `auth` block to the deployment profile YAMLs
  - PR-B (navi-backend #1): navi-config service serving /api/config on :8422
  - PR-C (this):       frontend consumes auth.* from /api/config

Behavior is unchanged in every case: the fallback literals are used if the
backend doesn't yet serve `auth` (older recon) or when FALLBACK_CONFIG is in
effect (offline / config API unreachable). useConfig() returns the cached
deployment config (null until loaded); the optional-chaining + ?? fallback
keeps clicks working before config loads.

Also adds the same `auth` block to src/config.js FALLBACK_CONFIG so offline
mode has working URLs.

No test added: navi has no test infrastructure today; flagged with a
TODO(navi) at the change site for when test infra lands.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/config.js

@@ -21,6 +21,10 @@ const FALLBACK_CONFIG = {
     address_book: '/api/address_book',
     valhalla: '/valhalla',
   },
+  auth: {
+    login_url: '/outpost.goauthentik.io/start?rd=%2F',
+    logout_url: 'https://auth.echo6.co/if/flow/default-invalidation-flow/?next=https://navi.echo6.co/',
+  },
   features: {
     has_nominatim_details: false,
     has_kiwix_wiki: false,