Bugfix - Work page public items requiring auth on initial load

[kdid]

Summary

Fixes intermittent "Authentication needed" banners on public work pages, embedded viewers, and the download/embed dialog. This was a gap left by #488/#489: those PRs fixed the same race condition for search result thumbnails but never touched the work-detail page, which had its own copy of the login-required logic. Also, that merged work dropped the !isAuthLoading guard, so the work page regressed.

Public, published works now render immediately regardless of auth state, matching the guarantee #489 gave search results. Non-public works now render neither the viewer nor the restricted banner until auth has actually resolved, which also fixes a potential reverse flash (a NetID user opening an Institution work could briefly see "Authentication needed" before the viewer swaps in).

fixes https://github.com/nulib/repodev_planning_and_docs/issues/5826

Changes

• hooks/useWorkAuth.ts — added a isWorkPublic && work.published short-circuit to userCanRead, independent of auth/user state; added a shared loginRequired (work && !userCanRead && !isAuthLoading) so restricted status is only asserted once auth has resolved; guarded scopes.includes with optional chaining so a malformed whoami payload can't throw during render
• pages/items/[...id].tsx — consume loginRequired from the hook instead of a local copy of the expression
• components/Work/EmbeddedViewer.tsx — accepts a loginRequired prop instead of computing it from isAuthLoading
• pages/embedded-viewer/[manifestId].tsx — passes loginRequired from the hook down to EmbeddedViewer
• components/Work/ActionsDialog/DownloadAndShare/EmbedResources.tsx — derives its "Download requires NetID" announcement from the hook's loginRequired, still exempting shared-link pages
• hooks/useWorkAuth.test.ts (new) — covers public+published during auth load, public with a failed/empty whoami, public-but-unpublished, non-public during load, non-public with/without matching scope, and a malformed user payload
• components/Work/EmbeddedViewer.test.tsx — updated for the prop change; added a case for the non-public/loading render-nothing state

Testing

• Clear the dcapi* cookie for library.northwestern.edu (12h TTL) and hard-reload a public work page — viewer should render with no banner (- or use Incognito mode)
• If desired, throttle /auth/whoami in DevTools to make the race reproducible; confirm no banner flash on a public work
• Confirm an Institution work while logged out still shows the banner (only after auth resolves, no flash), and the same work logged in with NetID goes straight to the viewer with no flash
• Check /embedded-viewer/[manifestId] for a public work, and the Download and Share dialog on a public work and a /shared/[id] link