fix: ProtectedRoute spinner fix, TokenSync cleanup, dev hot-reload

- ProtectedRoute: only gate on initial auth load, not every async op
- TokenSync: OrgResolver is sole source of org data, remove fetchUserInfo
- docker-compose.dev: mount ui/dist for hot-reload

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/ProtectedRoute.tsx

@@ -1,11 +1,20 @@
+import { useRef } from 'react';
 import { Navigate } from 'react-router';
 import { useLogto } from '@logto/react';
 import { Spinner } from '@cameleer/design-system';
 
 export function ProtectedRoute({ children }: { children: React.ReactNode }) {
   const { isAuthenticated, isLoading } = useLogto();
+  // The Logto SDK sets isLoading=true for EVERY async method (getAccessToken, etc.),
+  // not just initial auth. Only gate on the initial load — once isLoading is false
+  // for the first time, never show the spinner again.
+  const initialLoadDone = useRef(false);
 
-  if (isLoading) {
+  if (!isLoading) {
+    initialLoadDone.current = true;
+  }
+
+  if (!initialLoadDone.current) {
     return (
       <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
         <Spinner />