Merge branch 'feature/seaman' of https://github.com/Tria-plc/emaui into certficate

libs/auth/src/lib/components/ProtectedRoute.tsx

@@ -10,6 +10,9 @@ interface ProtectedRouteProps {
 
 export function ProtectedRoute({ children, loginPath = '/login' }: ProtectedRouteProps) {
   const location = useLocation();
+  // `authStorage` is already scoped to this app; the bare key is only the
+  // legacy pre-prefix session. Never read a sibling app's token — that is how
+  // a backoffice tab ends up authenticated as a portal applicant.
   const token = authStorage.getToken() ?? Cookies.get('auth-token');
 
   if (!token) {