fix: align dashboard guard with fallback menu access

apps/dashboard/src/components/layout/DashboardAccessGuard.boundary.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { resolveDashboardRoutePolicy, roleCanAccessPolicy } from '@/lib/dashboardRoutePolicies'
-import { flattenInternalRoutes, isAllowedRoute, resolveAccessRedirect } from './DashboardAccessGuard'
+import { flattenInternalRoutes, getBaselineInternalRoutes, isAllowedRoute, resolveAccessRedirect, resolveAllowedRoutes } from './DashboardAccessGuard'
 
 describe('DashboardAccessGuard route helpers', () => {
   it('normalizes dashboard-prefixed menu routes before checking access', () => {
@@ -35,6 +35,46 @@ describe('DashboardAccessGuard route helpers', () => {
     expect(resolveAccessRedirect('/fleet', [])).toBeNull()
   })
 
+  it('uses the approved baseline routes when active subscription menu data is empty or root-only', () => {
+    expect(resolveAllowedRoutes({ items: [], subscriptionAccessLevel: 'full' }, 'OWNER')).toEqual([
+      '/',
+      '/reservations',
+      '/fleet',
+      '/customers',
+      '/reports',
+      '/billing',
+      '/settings',
+    ])
+
+    expect(resolveAllowedRoutes({
+      subscriptionAccessLevel: 'full',
+      items: [
+        {
+          id: 'dashboard',
+          itemType: 'INTERNAL_PAGE',
+          routeOrUrl: '/',
+          children: [],
+        },
+      ],
+    }, 'MANAGER')).toEqual([
+      '/',
+      '/reservations',
+      '/fleet',
+      '/customers',
+      '/reports',
+      '/billing',
+    ])
+  })
+
+  it('does not apply baseline fallback when subscription access is none', () => {
+    expect(resolveAllowedRoutes({ items: [], subscriptionAccessLevel: 'none' }, 'OWNER')).toEqual([])
+  })
+
+  it('filters baseline routes by role', () => {
+    expect(getBaselineInternalRoutes('AGENT')).toEqual(['/', '/reservations', '/fleet', '/customers'])
+    expect(getBaselineInternalRoutes('MANAGER')).toEqual(['/', '/reservations', '/fleet', '/customers', '/reports', '/billing'])
+  })
+
   it('redirects disallowed routes to the first visible internal route', () => {
     expect(resolveAccessRedirect('/settings', ['/', '/fleet'])).toBe('/')
     expect(resolveAccessRedirect('/fleet/123', ['/', '/fleet'])).toBeNull()