Show loading state during initial identity read

Found while working Task 11936 (stalled connections on some ISP paths). With no cached identity (a first visit, or after a sign-out) and `/api/auth/me` slow or stalled, the whole console is a blank page: no spinner and no stall notice. `RequireAuth` renders `null` while `loading`, and the stall banner sits inside the shell, which is not mounted yet. Reproduced on a local stack with Playwright by holding `/api/auth/me` for 20 s on a fresh browser context: a blank light page for the whole wait. Requirements: 1. While the first identity read is in flight, show the shell's loading state rather than an empty page. 2. If that read passes the stall threshold (`apps/web/src/lib/requestStall.ts`), show the stall notice there too. Out of scope: the read relay and the `RequireSuperadmin` unresolved-yes fix (shipped in Task 11936, PR #7522); second-hostname failover (Task 11931). Done means: - With `/api/auth/me` held on a fresh browser context, the page shows a loading indicator within one frame, and the stall notice after the threshold. - `./dc check quick` green; changed-area tests green.

RequireAuth now shows the shell spinner plus stall notice while the first /api/auth/me read is out (was blank). Live check: spinner at first paint, notice at 8.7s; quick gate + App tests green. PR #7525 queued. Memory: none applied.