Show project picker before login/waiting-room gates so auth failures don't replace it mid-flash

Author: jahooma

cli/src/app.tsx

@@ -260,6 +260,20 @@ export const App = ({
     // 4xx client errors (401, 403, etc.) keep 'ok' - network is fine, just auth failed
   }
 
+  // Render project picker FIRST when at home directory or outside a project.
+  // This deliberately precedes the login/auth and waiting-room gates so the
+  // user always gets to pick a working directory before anything else — auth
+  // failures or a banned/queued freebuff session would otherwise replace the
+  // picker mid-flash and look like being kicked out of the app.
+  if (showProjectPicker) {
+    return (
+      <ProjectPickerScreen
+        onSelectProject={onProjectChange}
+        initialPath={projectRoot}
+      />
+    )
+  }
+
   // Render login modal when not authenticated AND auth service is reachable
   // Don't show login modal during network outages OR while retrying
   if (
@@ -275,16 +289,6 @@ export const App = ({
     )
   }
 
-  // Render project picker when at home directory or outside a project
-  if (showProjectPicker) {
-    return (
-      <ProjectPickerScreen
-        onSelectProject={onProjectChange}
-        initialPath={projectRoot}
-      />
-    )
-  }
-
   // Use key to force remount when resuming a different chat from history
   const chatKey = resumeChatId ?? 'current'