Decode JWT client-side instead of calling /api/auth/me

- Add lib/auth.ts with decodeJWT() and isTokenValid()
- Layout decodes JWT directly - no extra request
- Domains page also uses JWT for admin check
- Removed redundant user.domains from domains list page

frontend/src/lib/auth.ts

@@ -0,0 +1,28 @@
+interface JWTPayload {
+  userId: number;
+  username: string;
+  role: string;
+  exp: number;
+  iat: number;
+}
+
+export function decodeJWT(token: string): JWTPayload | null {
+  try {
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+    
+    const payload = parts[1];
+    const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+
+export function isTokenValid(token: string): boolean {
+  const payload = decodeJWT(token);
+  if (!payload) return false;
+  
+  const now = Math.floor(Date.now() / 1000);
+  return payload.exp > now;
+}