fix(gateway): resolve tenant switch mismatch for non-owner users

Non-owner tenant switch set only tenant_hint in localStorage, but WS
Path 1 non-owner and HTTP client only read tenant_id — causing silent
fallback to MasterTenantID.

Frontend: always set TENANT_ID on switch; keep TENANT_HINT for pairing compat.
Backend: WS Path 1 non-owner now falls back to TenantHint before deprecated TenantScope.

internal/gateway/router.go

@@ -145,7 +145,10 @@ func (r *MethodRouter) handleConnect(ctx context.Context, client *Client, req *p
 			// Non-owner with gateway token: resolve tenant via hint or membership
 			hint := params.TenantID
 			if hint == "" {
-				hint = params.TenantScope
+				hint = params.TenantHint
+			}
+			if hint == "" {
+				hint = params.TenantScope // deprecated
 			}
 			tid, errCode := r.resolveTenantHint(ctx, hint, params.UserID)
 			if errCode != "" {

ui/web/src/components/layout/topbar.tsx

@@ -131,11 +131,10 @@ function UserMenu() {
   const tenantLabel = currentTenant?.name || currentTenantName || "";
 
   const handleSwitchTenant = (_tenantId: string, slug: string) => {
-    // Owner: narrow scope to specific tenant
-    // Non-owner: use tenant_hint for pairing
-    if (isOwner) {
-      localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_ID, slug);
-    } else {
+    // Always set TENANT_ID so WS and HTTP both resolve the correct tenant.
+    localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_ID, slug);
+    // Non-owner: also set TENANT_HINT for browser pairing backward compat (Path 3a).
+    if (!isOwner) {
       localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_HINT, slug);
     }
     window.location.reload();