fix: refresh navigation permissions before login and on scoped renders

web/static/js/auth.js

@@ -47,6 +47,7 @@ function clearAuthStorage() {
     authRoles = [];
     authPermissions = new Set();
     authScope = '';
+    applyRBACToUI();
     try {
         localStorage.removeItem(AUTH_STORAGE_KEY);
     } catch (error) {
@@ -505,6 +506,12 @@ function installPermissionClickGuard() {
 function applyRBACToUI(root) {
     installPermissionClickGuard();
     document.querySelectorAll('[data-page]').forEach((el) => {
+        // Navigation permissions must also be refreshed during scoped renders.
+        // Explicit rules take precedence over the fallback page permission map.
+        if (el.hasAttribute('data-require-permission') || el.hasAttribute('data-require-permission-any')) {
+            applyPermissionElement(el);
+            return;
+        }
         const page = el.getAttribute('data-page');
         const permission = PAGE_PERMISSION_MAP[page];
         if (!permission) return;