fix(auth): handle zero-permission users gracefully and prevent redirect loops

src/components/layout/nav.ts

@@ -1,4 +1,5 @@
 import type { LucideIcon } from 'lucide-react'
+import { can } from '@/auth/store'
 import {
   BookOpenText,
   Bot,
@@ -100,3 +101,15 @@ export const NAV_GROUPS: NavGroup[] = [
     ],
   },
 ]
+
+export function getFirstAccessibleRoute(): string | null {
+  for (const group of NAV_GROUPS) {
+    for (const item of group.items) {
+      if (!item.permission || can(item.permission)) {
+        return item.to
+      }
+    }
+  }
+  return null
+}
+