update some minor auth ux issues

frontend/src/routes/[fam]/+layout.svelte

@@ -22,11 +22,8 @@
 	let accessReason = $derived(data.famAccess?.reason || '');
 	// Settings stays usable while paused so admins can apply a code / manage billing.
 	let hasAuth = $derived(!!data.session);
-	let locked = $derived(disabled && !page.url.pathname.endsWith('/settings'));
+	let locked = $derived((disabled && !page.url.pathname.endsWith('/settings')) || !hasAuth);
 
-	$effect(() => {
-		console.log(data, page.url.pathname.includes('/join'), locked);
-	});
 	// ── Post-checkout activation (event-driven) ──
 	// Landing with ?checkout=return: if the webhook has already landed we show
 	// the welcome notice; otherwise show an "activating" state and wait for the