If auth status is unknown, showing a loading state avoids both premature redirects and accidental private UI flashes.