Hide inserted estimates from client list; redirect anon to /signin

Estimates with status Inserted (provider hasn't worked on them yet)
were showing up in the client's "Mes devis à valider" list. The
asclient endpoint now requires ProviderValidationDate to be set, so
only estimates the provider has actually established and submitted
are visible to the client. The asprovider endpoint is unchanged
(providers still need to see incoming unprocessed requests).

Also fix the anonymous-access redirect on Yavsc.Org: the application
cookie's LoginPath defaulted to /Account/Login, which has no
controller. Anonymous hits to a restricted page now redirect to the
real /signin endpoint (with /signout and /Account/AccessDenied set
to match the existing controller routes).

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/Yavsc.Api/Controllers/Business/EstimateApiController.cs

@@ -201,12 +201,18 @@ namespace Yavsc.Controllers
         // GET: api/estimate/asclient
         // Ongoing estimates (not yet validated by the client) where the
         // current user is the client who initiated the request.
+        // An estimate only becomes visible to the client once the provider
+        // has actually established and submitted it (ProviderValidationDate);
+        // a freshly inserted request the provider hasn't worked on yet is
+        // not something the client can validate, so it's excluded.
         [HttpGet("asclient")]
         public IActionResult GetOngoingEstimatesAsClient()
         {
             var uid = User.GetUserId();
             return Ok(_context.Estimates.Include(e => e.Bill)
-                .Where(e => e.ClientId == uid && e.ClientValidationDate == default));
+                .Where(e => e.ClientId == uid
+                    && e.ProviderValidationDate != default
+                    && e.ClientValidationDate == default));
         }
 
         // GET: api/estimate/asprovider