[UI-12] Mock auth will 401-loop once tenant APIs require JWT

[PatStLouis]

Surfaced on #175.

The tenants list/detail pages call the real API (GET /api/v1/tenants, GET /api/v1/tenants/:id) while auth defaults to mock mode (mock-token-… in sessionStorage). That works today only because TenantController is still unguarded.

When #165 rolls JwtGuard / ScopeGuard / TenantGuard onto those routes, the client will:

1. attach the fake bearer token
2. get 401
3. refresh another fake token
4. 401 again (_retried)
5. onAuthFailure → mock logout

/tenants will look like it "randomly" signs the user out.

Options (pick one when #165 reaches the tenant surface):

• Keep mock mode talking to MSW / a local unguarded fixture, not the live API
• Give mock auth a real app-issued token (dev-only client_credentials or a seed user)
• Document in apps/ui/README.md that mock + guarded APIs is unsupported and OIDC (VITE_AUTH_MODE=oidc, [UI-02] Login and auth integration #83) is required

Dependencies

• Blocked by [UI-01] React app scaffold and routing #82
• Coordinate with [AU-followup] Roll out JWT guards to all API controllers #165 (guard rollout) and [UI-02] Login and auth integration #83 (real OIDC)

Definition of Done

• Implementation complete and builds without errors
• Unit/integration tests pass
• PR reviewed and approved
• No regressions in existing functionality