fix(auth): restore session before registering router to prevent refresh redirect

- Move app.use(router) after await authStore.init() so the beforeEach guard
  sees the correct isAuthenticated state on page load
- Fix backfill_session_costs._root_prefix: remove underscore→dash replacement
  that caused paths like /Users/ai_leed/... to not match ~/.claude/projects/ folders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/backfill_session_costs.py

@@ -51,7 +51,7 @@ def _get_pricing(model: str) -> tuple[float, float, float, float]:
 
 
 def _root_prefix(root_path: str) -> str:
-    return root_path.rstrip("/").replace("/", "-").replace("_", "-")
+    return root_path.rstrip("/").replace("/", "-")
 
 
 def _match_root(folder_key: str) -> str | None:

web/src/main.ts

@@ -14,7 +14,6 @@ initMsal().then(async () => {
   const pinia = createPinia()
 
   app.use(pinia)
-  app.use(router)
   app.use(VueQueryPlugin)
 
   const authStore = useAuthStore()
@@ -27,8 +26,10 @@ initMsal().then(async () => {
     (token) => authStore.setToken(token),
   )
 
-  // Restore session from HttpOnly refresh cookie before mounting
+  // Restore session BEFORE registering router so the beforeEach guard
+  // sees the correct isAuthenticated state on initial navigation
   await authStore.init()
 
+  app.use(router)
   app.mount('#app')
 })