fix: prevent vendor redirect to /tenant on hard refresh

RequireScope and LandingRedirect now wait for scopesReady flag before
evaluating, preventing the race where org-scoped tokens load before
global tokens and the vendor gets incorrectly redirected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/useOrganization.ts

@@ -12,6 +12,7 @@ interface OrgState {
   currentTenantId: string | null; // DB UUID — used for API calls like /api/tenants/{id}
   organizations: OrgInfo[];
   scopes: Set<string>;
+  scopesReady: boolean;           // true once OrgResolver has finished loading scopes
   username: string | null;
   setCurrentOrg: (orgId: string | null) => void;
   setOrganizations: (orgs: OrgInfo[]) => void;
@@ -24,6 +25,7 @@ export const useOrgStore = create<OrgState>((set, get) => ({
   currentTenantId: null,
   organizations: [],
   scopes: new Set(),
+  scopesReady: false,
   username: null,
   setUsername: (name) => set({ username: name }),
   setCurrentOrg: (orgId) => {
@@ -39,5 +41,5 @@ export const useOrgStore = create<OrgState>((set, get) => ({
       currentTenantId: match?.tenantId ?? get().currentTenantId,
     });
   },
-  setScopes: (scopes) => set({ scopes }),
+  setScopes: (scopes) => set({ scopes, scopesReady: true }),
 }));