Guard user.email access in fragment middleware

Handle case where email is None for pre-existing sessions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/__init__.py

@@ -170,7 +170,7 @@ def create_app() -> FastAPI:
         from artdag_common.fragments import fetch_fragments as _fetch_frags
 
         user = get_user_from_cookie(request)
-        auth_params = {"email": user.email} if user else {}
+        auth_params = {"email": user.email} if user and user.email else {}
         nav_params = {"app_name": "artdag", "path": path}
 
         try: