fix(onboarding): stop new-user redirect loop back to setup flow

[posthog-eu]

Summary

• New users created after the 2026-08-04 cutoff with one org and one app still flagged need_onboarding were bounced back to /app/new?resume=<appId> on nearly every navigation. This sits on the signup-to-activation path and repeats per user rather than firing once.
• Root cause: the exploration grant lived in a module-level variable in src/utils/onboardingRedirect.ts, so it died on every full page load and had to be re-granted through the confirm dialog each time. The only exempt route was /app/new, so the app dashboard and app settings pages were both caught.
• Fix keeps the guard (per the team decision in #2926, after #2890 was closed unmerged) and repairs the state persistence:
  • Store the exploration grant in sessionStorage (with a module-memory fallback for blocked storage) so it survives a page reload.
  • Exempt /app/<id>/settings and its sub-routes so onboarding users can read their own app id without being ejected.

Test plan

• bunx vitest run tests/onboarding-redirect.unit.test.ts tests/auth-sso-provisioning.unit.test.ts
• New unit coverage:
  • The exploration grant stays granted after a simulated page reload (module reset keeps the sessionStorage value).
  • App settings paths (/app/<id>/settings, /app/<id>/settings/access) return no redirect.
• bun run lint and bun run typecheck:frontend pass.

Screenshots

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixonboarding-prevent-redirect-loop-629111 (349305f) with main (b62668a)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud