fix: 'No tenant selected' error during onboarding

[dimavedenyapin]

Summary

• During onboarding, after login + tenant selection, the dashboard shows: "No tenant selected — please select an organization"
• Root cause: selectTenant() stores JWT + tenant ID, then calls fetchAndStoreAiGatewayVirtualKey(). If that call triggers a 401 retry that fails, apiRequest()'s catch block calls clearStoredData() — wiping the JWT and tenant ID that were just stored. selectTenant() catches this as a non-fatal warning, but the DB is already empty.

What changed

1. EnterpriseAuthError class with AuthErrorCode enum (enterprise-auth.ts)

• Typed error class replaces raw throw new Error(string) for all auth-related failures
• Error codes: SESSION_EXPIRED, NO_REFRESH_TOKEN, NO_TENANT, NOT_AUTHENTICATED, PERMISSION_DENIED, API_ERROR

2. Prevent double clearStoredData() (enterprise-auth.ts)

• When executeRefresh() throws a typed EnterpriseAuthError (which already ran clearStoredData() if needed), apiRequest()'s 401-handler now propagates it directly instead of wrapping and clearing again
• This is the actual fix — the double-clear was nuking tenant state during selectTenant's sub-call

3. IPC error code propagation (ipc-handlers.ts)

• Electron IPC only serializes Error.message — custom fields are lost
• enterprise:apiRequest handler now wraps EnterpriseAuthError as "[CODE] message" so the renderer gets structured codes

4. Dashboard uses error codes (dashboard-store.ts)

• isAuthError() now checks structured [CODE] prefixes first
• Legacy string patterns kept as fallback for pre-migration errors
• No more fragile string matching for new error paths

Test plan

• Login → select tenant → dashboard loads without "No tenant selected" error
• If AI gateway key fetch fails → session survives, dashboard still works
• Genuine session expiry → dashboard triggers re-login flow
• Error codes visible in IPC errors: [SESSION_EXPIRED] Session expired...

🤖 Generated with Claude Code