fix: prevent vendor redirect to /tenant on hard refresh

RequireScope and LandingRedirect now wait for scopesReady flag before
evaluating, preventing the race where org-scoped tokens load before
global tokens and the vendor gets incorrectly redirected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/router.tsx

@@ -22,13 +22,12 @@ import { TenantAuditPage } from './pages/tenant/TenantAuditPage';
 
 function LandingRedirect() {
   const scopes = useScopes();
-  const { organizations, currentOrgId } = useOrgStore();
+  const { organizations, currentOrgId, scopesReady } = useOrgStore();
   const currentOrg = organizations.find((o) => o.id === currentOrgId);
 
-  // Wait for scopes to be resolved — they're loaded async by OrgResolver.
-  // An empty set means "not yet loaded" (even viewer gets observe:read).
-  if (scopes.size === 0) {
-    return null; // OrgResolver is still fetching tokens
+  // Wait for scopes to be fully resolved by OrgResolver before redirecting.
+  if (!scopesReady) {
+    return null;
   }
 
   // Vendor → vendor console