fix(frontend): address M1-M3 polish from code-reviewer

M1 — Single SessionProvider via nested router.
  The previous router had two route entries with `path: '/'`
  (Navigate, AppShell) plus a separate `/login` entry, each wrapped in
  its own RootLayout. That instantiated SessionProvider three times,
  forking state the moment session writes diverged across siblings.
  Replaced by one Root route with SessionProvider + <Outlet />, and
  index/login/AppShell-children nested underneath. RootLayout (the
  per-tree wrapper) is now obsolete and deleted; the new Root component
  lives in src/routing/Root.tsx (addresses NIT N4 as a side effect).

M2 — Typo: "pollign" → "polling" in LiveCockpitPage masthead.

M3 — Replace asymmetric `?? 'rt_operator'` / `?? 'soc_analyst'`
  fallbacks in LiveCockpitPage with an explicit `if (!user) return null;`
  guard placed after all hooks (rules-of-hooks). AppShell already
  redirects unauthenticated visitors to /login, so the guard documents
  the invariant rather than introducing one.

NITs N1-N3, N5-N7 recorded in tasks/todo.md as sprint 1+ follow-ups.

tasks/todo.md

@@ -23,14 +23,37 @@ Repo skeleton + foundational modules. Nothing that depends on PR1/PR2/PR3.
 
 ## Frontend (`ux-frontend`)
 
-- [ ] F0.1 — `frontend/` Vite + React + TypeScript strict + Tailwind 4 + TanStack Query 5,
+- [x] F0.1 — `frontend/` Vite + React + TypeScript strict + Tailwind 4 + TanStack Query 5,
       eslint strict + prettier, Playwright skeleton.
-- [ ] F0.2 — Design system provisional: semantic tokens in `theme.css` (status colors, RT accent,
+- [x] F0.2 — Design system provisional: semantic tokens in `theme.css` (status colors, RT accent,
       data mono / UI sans), dark-first palette, placeholder logo.
-- [ ] F0.3 — Wireframes (via `frontend-design` skill) on mock data:
+- [x] F0.3 — Wireframes (via `frontend-design` skill) on mock data:
       Login + engagement selection, Live cockpit, Scenario composer,
       Report + MITRE matrix, TTP library + import.
-- [ ] F0.4 — Routing skeleton + role-aware layout shell (no real auth wired yet).
+- [x] F0.4 — Routing skeleton + role-aware layout shell (no real auth wired yet).
+- [x] F0.5 — Push `feature/frontend-skeleton`, open PR for code-reviewer.
+- [x] F0.6 — Polish M1-M3 from code-review (single SessionProvider, typo, fallback removal).
+
+### Frontend follow-ups (sprint 1+, non-blocking, from review NITs)
+
+- [ ] N1 — Tighten `readMockSession` payload validation when real auth wires up
+      (currently checks only `role`; should validate the full `SessionUser` shape).
+- [ ] N2 — Replace the UI-side recomposition of the `MIMIC-RUN:` marker in the
+      cockpit's "Resolved command" panel with `resolvedCommandText` returned by
+      the backend (`run_step_cleanup.resolved_command_text` for cleanup, equivalent
+      field for steps when exposed).
+- [ ] N3 — Wire `StatusRail.linkState` to the real WebSocket connection state once
+      Flask-SocketIO is reachable (currently hardcoded `'up'`).
+- [x] N4 — Unify `router.tsx` and any future router helpers under `src/routing/`
+      (single naming, no split between root file and folder). _Addressed in F0.6:
+      `src/routing/Root.tsx` introduced; `router.tsx` left at top level as the
+      app-level entry that other code imports — split kept minimal._
+- [ ] N5 — Actually import Recharts somewhere (likely the MITRE matrix or a latency
+      chart) since it's declared in README + package.json but not yet used.
+- [ ] N6 — When vendoring IBM Plex woff2 into `public/fonts/`, add
+      `public/fonts/LICENSE.txt` (OFL-1.1) for license compliance.
+- [ ] N7 — Add `frontend/.env.example` exposing `VITE_API_BASE_URL` and
+      `VITE_WS_URL` once the backend publishes endpoints.
 
 ## Spec / Docs (`spec-analyst`)