fix(02-07): use kotlinx.coroutines.test.runTest in commonTest for wasmJs

- Add kotlinx-coroutines-test to commonTest dependencies in composeApp
- Refactor AuthSessionTest and LoginViewModelTest from runBlocking to runTest
  so the wasmJs test target compiles (runBlocking is JVM/Native-only)
- App.kt picks up spotless-imposed brace blocks under the auth-gate when
- Log pre-existing SecureAuthStateStoreContractTest and ios SecureAuthStateStore
  ktlint failures to deferred-items.md (out of scope per gsd scope-boundary rule)

Rule 3 (blocking): adding the multiplatform test runtime is needed so
./gradlew check on commonTest sources can compile across all KMP targets.

.planning/phases/02-authentication-foundation/deferred-items.md

@@ -0,0 +1,24 @@
+# Deferred Items — Phase 02 (auth foundation)
+
+## Pre-existing failures discovered during 02-07 `./gradlew check`
+
+### `SecureAuthStateStoreContractTest` (Android JVM unit test) — pre-existing
+
+- **Tests:** `clearRemovesStoredValue`, `writeOverwritesPreviousValueAndReadReturnsLatest`
+- **File:** `composeApp/src/androidUnitTest/.../SecureAuthStateStoreContractTest.kt`
+- **Failure:** `java.lang.IllegalStateException` at construction (Android Keystore not available in
+  plain JVM unit tests under Robolectric-less harness).
+- **Provenance:** Reproduced on `master` HEAD before any 02-07 change (verified via `git stash`
+  + run of `./gradlew :composeApp:testDebugUnitTest`).
+- **Not caused by 02-07.** Source plan was 02-04 (Android secure-store actuals). Likely
+  needs Robolectric or an instrumented (`androidTest`) target. Out of scope for 02-07's
+  UI gate plan.
+- **Action:** Track for a follow-up Android-test infra task; do not block Phase 02 on it.
+
+### Spotless `property-naming` lint in `SecureAuthStateStore.ios.kt:L31` — pre-existing
+
+- Reproduced on `master` HEAD before any 02-07 change.
+- Source plan: 02-05 (iOS auth actuals).
+- ktlint expects SCREAMING_SNAKE_CASE for an immutable property; the iOS implementation
+  uses camelCase. Fix is a one-line rename or `suppressLintsFor` annotation.
+- Out of scope for 02-07; track for follow-up.