feat: role-based sidebar visibility and landing redirect

- Vendor (platform:admin): sees only TENANTS in sidebar
- Tenant admin (tenant:manage): sees Dashboard, License, OIDC, Team, Settings
- Regular user (operator/viewer): redirected to server dashboard directly
- LandingRedirect checks scopes in priority order: vendor > admin > server

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/Layout.tsx

@@ -34,6 +34,7 @@ export function Layout() {
   const { username, organizations, currentOrgId } = useOrgStore();
 
   const isVendor = scopes.has('platform:admin');
+  const isTenantAdmin = scopes.has('tenant:manage');
 
   // Determine current org slug for server dashboard link
   const currentOrg = organizations.find((o) => o.id === currentOrgId);
@@ -41,7 +42,7 @@ export function Layout() {
 
   // Build breadcrumbs from path
   const segments = location.pathname.replace(/^\//, '').split('/').filter(Boolean);
-  const breadcrumb = segments.map((seg, i) => {
+  const breadcrumb = segments.map((seg) => {
     const label = seg.charAt(0).toUpperCase() + seg.slice(1).replace(/-/g, ' ');
     return { label };
   });
@@ -67,56 +68,60 @@ export function Layout() {
         </Sidebar.Section>
       )}
 
-      {/* Tenant portal */}
-      <Sidebar.Section
-        icon={<LayoutDashboard size={16} />}
-        label="Dashboard"
-        open={false}
-        active={location.pathname === '/tenant'}
-        onToggle={() => navigate('/tenant')}
-      >
-        {null}
-      </Sidebar.Section>
+      {/* Tenant portal — only visible to tenant admins (tenant:manage scope) */}
+      {isTenantAdmin && (
+        <>
+          <Sidebar.Section
+            icon={<LayoutDashboard size={16} />}
+            label="Dashboard"
+            open={false}
+            active={location.pathname === '/tenant'}
+            onToggle={() => navigate('/tenant')}
+          >
+            {null}
+          </Sidebar.Section>
 
-      <Sidebar.Section
-        icon={<ShieldCheck size={16} />}
-        label="License"
-        open={false}
-        active={isActive(location, '/tenant/license')}
-        onToggle={() => navigate('/tenant/license')}
-      >
-        {null}
-      </Sidebar.Section>
+          <Sidebar.Section
+            icon={<ShieldCheck size={16} />}
+            label="License"
+            open={false}
+            active={isActive(location, '/tenant/license')}
+            onToggle={() => navigate('/tenant/license')}
+          >
+            {null}
+          </Sidebar.Section>
 
-      <Sidebar.Section
-        icon={<KeyRound size={16} />}
-        label="OIDC"
-        open={false}
-        active={isActive(location, '/tenant/oidc')}
-        onToggle={() => navigate('/tenant/oidc')}
-      >
-        {null}
-      </Sidebar.Section>
+          <Sidebar.Section
+            icon={<KeyRound size={16} />}
+            label="OIDC"
+            open={false}
+            active={isActive(location, '/tenant/oidc')}
+            onToggle={() => navigate('/tenant/oidc')}
+          >
+            {null}
+          </Sidebar.Section>
 
-      <Sidebar.Section
-        icon={<Users size={16} />}
-        label="Team"
-        open={false}
-        active={isActive(location, '/tenant/team')}
-        onToggle={() => navigate('/tenant/team')}
-      >
-        {null}
-      </Sidebar.Section>
+          <Sidebar.Section
+            icon={<Users size={16} />}
+            label="Team"
+            open={false}
+            active={isActive(location, '/tenant/team')}
+            onToggle={() => navigate('/tenant/team')}
+          >
+            {null}
+          </Sidebar.Section>
 
-      <Sidebar.Section
-        icon={<Settings size={16} />}
-        label="Settings"
-        open={false}
-        active={isActive(location, '/tenant/settings')}
-        onToggle={() => navigate('/tenant/settings')}
-      >
-        {null}
-      </Sidebar.Section>
+          <Sidebar.Section
+            icon={<Settings size={16} />}
+            label="Settings"
+            open={false}
+            active={isActive(location, '/tenant/settings')}
+            onToggle={() => navigate('/tenant/settings')}
+          >
+            {null}
+          </Sidebar.Section>
+        </>
+      )}
 
       <Sidebar.Footer>
         <Sidebar.FooterLink