fix: prevent vendor redirect to /tenant on hard refresh

RequireScope and LandingRedirect now wait for scopesReady flag before
evaluating, preventing the race where org-scoped tokens load before
global tokens and the vendor gets incorrectly redirected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/RequireScope.tsx

@@ -1,4 +1,5 @@
 import { useScopes } from '../auth/useScopes';
+import { useOrgStore } from '../auth/useOrganization';
 
 interface Props {
   scope: string;
@@ -8,6 +9,8 @@ interface Props {
 
 export function RequireScope({ scope, children, fallback }: Props) {
   const scopes = useScopes();
+  const scopesReady = useOrgStore((s) => s.scopesReady);
+  if (!scopesReady) return null; // Still loading — don't redirect yet
   if (!scopes.has(scope)) return fallback ? <>{fallback}</> : null;
   return <>{children}</>;
 }