#7692 fix(navigation): land on workspaces from the app entry, not settings

Summary

• Opening the app as an organization member whose organization has not been rolled out landed on the General settings form instead of a workspace. Send them to the workspace picker, which is where the entry pointed before the organization surface existed.
• The default landing never opens settings. The /o guards still fall back to settings for viewers who explicitly asked for the organization surface — that case is unchanged.
• Fixed an infinite /home ↔ /login redirect loop on a stale session cookie. The proxy treats /home as an app surface and redirects cookie-less requests to /login before the route renders, and auth-disabled deployments always resolve an anonymous session — so a null session inside /home always means a present-but-invalid cookie. Redirecting that to /login was bounced straight back by the proxy's presence-only cookie check, looping until the browser gave up and leaving the viewer unable to reach the login page at all. It now hands off to the workspace loader, the one identity-recovery surface, which clears the stale cookies before navigating.

Type of Change

• Bug fix

Testing

• 22 tests pass across app/home and lib/navigation. Both fixes verified to fail when reverted.
• bun run lint, block-registry audit, all 46 audits (check:audits), docs-manifest:check, and type-check pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)