[codex] defer admin tour until compliance is ready

[xwil1]

Summary

• defer the admin onboarding tour until admin compliance status has loaded
• prevent the tour from starting while the compliance acknowledgement dialog is required
• add regression coverage for first-login compliance gating

Root cause

The admin tour scheduled its auto-start as soon as AppLayout mounted. On first admin login, the compliance acknowledgement status is loaded asynchronously, so the tour could call drive(0) before the required compliance dialog finished.

Validation

• cd frontend && ./node_modules/.bin/vitest run src/composables/__tests__/useOnboardingTour.spec.ts
• cd frontend && ./node_modules/.bin/vue-tsc --noEmit
• cd frontend && ./node_modules/.bin/eslint src/composables/useOnboardingTour.ts src/composables/__tests__/useOnboardingTour.spec.ts
• git diff --check

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[xwil1]

I have read the CLA Document and I hereby sign the CLA

[xwil1]

recheck