fix(auth): token() soft-refresh also carries pendingRequests (#4436)

token() refreshed user/abilities/nav but, unlike refreshAbilities(), never
reassigned pendingRequests. After the refreshAbilities()->token() onboarding
swap, the org-required wall's "request pending" banner and its duplicate-request
guard (Request-to-join disabled while pendingRequests) went stale in-session on
the join path. /token already returns pendingRequests; token() just dropped it.

Add `this.pendingRequests = res.data.pendingRequests || []` so token() is a true
soft-refresh superset — fixes proceedToApp, the wall refresh()/requestToJoin(),
and every other token() site, and clears a stale banner too.

Tests: token() populates + clears pendingRequests.

Claude-Session: https://claude.ai/code/session_01XioM62H2iEMLsr686minjn

Author: PierreBrisorgueil

src/modules/auth/stores/auth.store.js

@@ -335,6 +335,10 @@ export const useAuthStore = defineStore('auth', {
         this.auth = true;
         this.cookieExpire = res.data.tokenExpiresIn;
         this.user = res.data.user;
+        // Soft-refresh must carry pendingRequests too, so the org-required wall's
+        // join banner + duplicate-request guard stay accurate after a token()
+        // soft-refresh (mirrors refreshAbilities()). /token already returns it.
+        this.pendingRequests = res.data.pendingRequests || [];
 
         if (res.data.abilities) updateAbilities(res.data.abilities);
         if (res.data.user.lastLoginAt) {

src/modules/auth/tests/auth.store.unit.tests.js

@@ -470,6 +470,28 @@ describe('Auth Store', () => {
       expect(localStorage.getItem(`${config.cookie.prefix}LastLoginAt`)).toBe(lastLogin);
     });
 
+    it('should populate pendingRequests from the token response (soft-refresh superset)', async () => {
+      const authStore = useAuthStore();
+      const pending = [{ id: 'req-1', organizationId: { name: 'Acme' } }];
+      axios.get.mockResolvedValueOnce({
+        data: { user: { id: '789', roles: ['user'] }, tokenExpiresIn: Date.now() + 7200000, pendingRequests: pending },
+      });
+
+      await authStore.token();
+
+      expect(authStore.pendingRequests).toEqual(pending);
+    });
+
+    it('should clear a stale pendingRequests when the token response omits them', async () => {
+      const authStore = useAuthStore();
+      authStore.pendingRequests = [{ id: 'stale' }];
+      axios.get.mockResolvedValueOnce({ data: { user: { id: '789', roles: ['user'] }, tokenExpiresIn: 1 } });
+
+      await authStore.token();
+
+      expect(authStore.pendingRequests).toEqual([]);
+    });
+
     it('should handle token refresh error without logging to the console', async () => {
       const authStore = useAuthStore();
       const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});