Fix SSR browser gate: use browser from $app/environment

The gate check ran during SSR where navigator is undefined,
rendering the 'Unsupported browser' div into the initial HTML.
Now gated on browser (client-only) so SSR renders the app
and the gate evaluates in the browser.

frontend/src/routes/+layout.svelte

@@ -1,12 +1,13 @@
 <script>
 	import '../app.css';
+	import { browser } from '$app/environment';
 	import { checkBrowserGate } from '$lib/core/browserGate.js';
 
 	// UAT-3: hard-stop browser gate (CAPTURE.md §Browsers).
 	// Client-side only: the gate must be invisible to crawlers/bots
 	// and to any non-JS context, and the app must not render in an
 	// unsupported browser.
-	const gate = typeof navigator !== 'undefined' ? checkBrowserGate(navigator.userAgent) : null;
+	const gate = browser ? checkBrowserGate(navigator.userAgent) : null;
 	let unsupported = $state(gate ? !gate.supported : false);
 	let browserName = $state(gate ? gate.browser.name : 'this browser');
 </script>