🐛 Guard soft-refresh navigation and signout race #4459

What — Right after creating an organization a user can be bounced back to the "no workspace" wall; and a late-resolving refresh can un-logout a user who just signed out.
Why — A soft-refresh action that never throws is followed by unconditional navigation / has no in-flight guard against signout.

Scope —

• src/modules/organizations/views/organization.create.view.vue (~L111): await authStore.token(); this.$router.push(...) with no check that the refresh populated authStore.user.currentOrganization. token() swallows failures, so a transient blip leaves currentOrganization falsy and the app-router org-guard bounces the just-created org back to /organization-required. Same class fixed in verifyEmail.view.vue (fix(auth,organizations): surface failures in org-create and email-verification flows #4451) and guarded in organizations.required.view.vue; this sibling from the fix(auth,organizations): soft-refresh (token) at onboarding sites to prevent silent sign-out #4431 batch was missed. ERRORS.md (2026-07-16) documents the pattern.
• src/modules/auth/stores/auth.store.js signout() (~L287): no generation/in-flight guard shared with token()/refreshAbilities(). A token() dispatched before a concurrent signout() can resolve after it and re-populate auth=true/user/localStorage. Reachable from organizations.required.view.vue (Check-status + Sign-out on one screen).

Fix: guard the org-create navigation on authStore.user?.currentOrganization (mirror the sibling views); add an in-flight/generation guard so a soft-refresh continuation cannot write auth state after signout(). Tests: org-create failure path stays on page; signout wins the race.

Refs: internal audit cycle-1 2026-07-16 (H2 + M4); follows #4431/#4451.
Created via /dev:issue