fix: exclude /org paths from tenant auth guard in sidebar

/org/* is the org-admin portal — it has its own auth context and should
not redirect to /login. Add ORG_PATHS bypass and render null sidebar
on those routes (same pattern as /my/*).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/_lib/sidebar.tsx

@@ -25,6 +25,7 @@ const SUPER_ADMIN_LINKS = [
 const PUBLIC_PATHS = ['/login', '/signup', '/onboard', '/member-login'];
 const ADMIN_PATHS = ['/admin'];
 const MEMBER_PATHS = ['/my'];
+const ORG_PATHS = ['/org'];
 
 export function Sidebar() {
   const { admin, loading, logout } = useAuth();
@@ -45,6 +46,7 @@ export function Sidebar() {
     if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) return;
     if (ADMIN_PATHS.some((p) => pathname.startsWith(p))) return;
     if (MEMBER_PATHS.some((p) => pathname.startsWith(p))) return;
+    if (ORG_PATHS.some((p) => pathname.startsWith(p))) return;
     if (!admin) {
       router.replace(`/login?next=${encodeURIComponent(pathname)}`);
     }
@@ -90,6 +92,10 @@ export function Sidebar() {
     return null;
   }
 
+  if (ORG_PATHS.some((p) => pathname.startsWith(p))) {
+    return null;
+  }
+
   return (
     <nav className="w-52 shrink-0 bg-white border-r border-gray-200 p-4 flex flex-col">
       <span className="font-bold text-base mb-4">TOWER</span>