fix: canAccess + isModuleVisible fallback while permissions loading (contacts + settings link)

frontend/src/components/layout/Sidebar.tsx

@@ -50,8 +50,8 @@ export function Sidebar() {
   // Use hasPermission directly — permissions are loaded via useUserPermissions hook
   const canAccess = (perm?: string): boolean => {
     if (!perm) return true;
-    // While permissions are loading, show everything (backend 403 catches errors)
-    if (!user || (user.permissions?.length === 0 && user.is_system_admin === undefined)) return true;
+    // While permissions are loading (undefined), show everything; backend 403 catches errors
+    if (!user?.permissions && user?.is_system_admin === undefined) return true;
     return hasPermission(perm);
   };
 

frontend/src/components/layout/TopBar.tsx

@@ -23,8 +23,9 @@ export function TopBar() {
   const logoutMutation = useLogout();
   const minimizedWindows = useWindowStore((s) => s.windows.filter((w) => w.state === 'minimized'));
   const { hasPermission } = usePermission();
-  // Use hasPermission directly — permissions are loaded via useUserPermissions hook
+  // While permissions are loading (undefined), show everything; backend 403 catches errors
   const canAccess = (perm: string): boolean => {
+    if (!user?.permissions && user?.is_system_admin === undefined) return true;
     return hasPermission(perm);
   };
   const restoreWindow = useWindowStore((s) => s.restoreWindow);

frontend/src/hooks/useWorkspace.ts

@@ -51,6 +51,8 @@ export function useWorkspace() {
     // System admins see all modules regardless of workspace
     const user = useAuthStore.getState().user;
     if (user?.is_system_admin) return true;
+    // While permissions are loading (is_system_admin undefined), show everything
+    if (user && user.is_system_admin === undefined) return true;
     // If no workspace context, show all (backward compatible)
     if (!context?.workspace_id || !context?.modules?.length) return true;
     return visibleModuleKeys.has(moduleKey);