Session 17: Audit response — checkout 401 fix, hero prop 404 fix, Slate parsing fix, ALL tab cascade isolation, cookie/nav/footer/autocomplete polish (1438 tests)

web/src/components/BottomTabBar.tsx

@@ -2,6 +2,12 @@
 
 import { usePathname } from 'next/navigation';
 import { useParlay } from '@/contexts/ParlayContext';
+// Session 17 — gate the mobile bottom nav behind authentication.
+// Anonymous visitors landing on /pricing previously saw the full
+// Home/Read/Parlay/Ledger/Profile bar before signing up — confusing
+// surface area, and it visually overlapped the cookie-consent banner
+// (both pinned to bottom: 0).
+import { useAuth } from '@/contexts/AuthContext';
 
 const TABS = [
   { id: 'home', label: 'Home', href: '/dashboard', icon: HomeIcon },
@@ -17,8 +23,15 @@ const HIDE_ON = new Set(['/login', '/signup', '/auth/callback', '/']);
 export default function BottomTabBar() {
   const pathname = usePathname() || '/';
   const { open, legCount } = useParlay();
+  // Session 17 — bar hidden for anonymous visitors. The bar's
+  // destinations (Ledger, Profile, Parlay) all require auth anyway;
+  // pre-auth visitors just see broken links. Authentication state
+  // resolves async; while `loading` is true we err on the side of
+  // hiding the bar to avoid a flash for signed-out users.
+  const { user, loading } = useAuth();
 
   if (HIDE_ON.has(pathname)) return null;
+  if (loading || !user) return null;
 
   return (
     <nav