fix(auth): handle zero-permission users gracefully and prevent redirect loops

src/auth/permissions.ts

@@ -1,5 +1,6 @@
 import { redirect } from '@tanstack/react-router'
 import { can, useAuthStore } from '@/auth/store'
+import { getFirstAccessibleRoute } from '@/components/layout/nav'
 
 /**
  * Admin permission keys — mirrors the backend catalog
@@ -50,6 +51,7 @@ export type Permission = (typeof PERM)[keyof typeof PERM]
 export function requirePermission(permission: Permission): void {
   const { user } = useAuthStore.getState()
   if (user && !can(permission)) {
-    throw redirect({ to: '/' })
+    const target = getFirstAccessibleRoute()
+    throw redirect({ to: target && target !== '/' ? target : '/' })
   }
 }