[fix](trx-frontend-http): fix decode history invisible on first load

Two root causes:

1. /decode/history was classified as Control in the auth router (not listed
   in Read routes), so it returned 401/403 when auth is enabled and the
   user had no session or rx-only role. Add it to the Read route list.

2. connectDecode() was called from window.load unconditionally, before the
   auth flow completed. On first load with auth enabled the session cookie
   doesn't exist yet, so the history fetch fails silently. Move the call to
   be alongside connect() in initializeApp(), login, and guest handlers so
   it always runs with valid auth context.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js

@@ -3425,6 +3425,7 @@ async function initializeApp() {
     hideAuthGate();
     updateAuthUI();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
     return;
@@ -3437,6 +3438,7 @@ async function initializeApp() {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } else {
@@ -3463,6 +3465,7 @@ document.getElementById("auth-form").addEventListener("submit", async (e) => {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } catch (err) {
@@ -3484,6 +3487,7 @@ if (guestBtn) {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   });
@@ -6235,13 +6239,8 @@ function connectDecode() {
     }
   }).catch(() => { clearTimeout(historyTimeout); flushLiveBuffer(); });
 }
-if (document.readyState === "complete") {
-  connectDecode();
-} else {
-  window.addEventListener("load", () => {
-    connectDecode();
-  }, { once: true });
-}
+// connectDecode() is called from initializeApp() after auth succeeds,
+// and from login/guest handlers — no standalone window.load call needed.
 
 // Release PTT on page unload to prevent stuck transmit
 window.addEventListener("beforeunload", () => {

src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs

@@ -423,6 +423,7 @@ impl RouteAccess {
             || path == "/rigs"
             || path == "/events"
             || path == "/decode"
+            || path == "/decode/history"
             || path == "/spectrum"
             || path == "/audio"
             || path == "/bookmarks"
@@ -430,6 +431,7 @@ impl RouteAccess {
             || path.starts_with("/rigs?")
             || path.starts_with("/events?")
             || path.starts_with("/decode?")
+            || path.starts_with("/decode/history?")
             || path.starts_with("/spectrum?")
             || path.starts_with("/audio?")
             || path.starts_with("/bookmarks?")