fix(onboarding): isolate cached routing state per request (#459)

src/routes/_authenticated.onboarding.index.tsx

@@ -21,6 +21,10 @@ const clampStep = (step: number) =>
   Math.min(Math.max(0, Math.trunc(step)), ONBOARDING_LAST_STEP);
 
 export const Route = createFileRoute("/_authenticated/onboarding/")({
+  // The app renders inside ClientOnly, and this guard reads account-scoped data
+  // through a module-scoped query client. Keep it out of server requests so one
+  // worker isolate cannot reuse another account's cached onboarding state.
+  ssr: false,
   // Step lives in the URL so it survives refresh and works with back/forward.
   validateSearch: (search: Record<string, unknown>): { step: number } => {
     const raw = Number(search.step);