fix(web): stop phantom demo-fallback requests in seeds-off mode

App.tsx hardcoded fallbacks (active session "sess-001", projectId 1) sent
requests for nonexistent resources on fresh logins against real dev data,
producing 7+ console 404/403 hits. Fallbacks now resolve to empty/0; the
existing chatBlockedNoProject empty state and session-reconciliation effect
carry the UI, and demo-seeds-enabled builds keep the NEUROPULSE fallback.

Root cause, same-class scan, and before/after browser evidence (9 phantom
requests -> 0, author+member accounts) recorded in the task doc; ISSUES row
ISSUE-20260927-demo-fallback registered.

web/src/App.tsx

@@ -135,7 +135,8 @@ export default function App() {
 
   // 会话与用户状态 (支持 localStorage 刷新持久化)
   const [sessions, setSessions] = useState<ProjectSession[]>(() => loadSessions());
-  const [activeSessionId, setActiveSessionId] = useState<string>(() => loadActiveSessionId('sess-001'));
+  // demo seeds 开启时由 NEUROPULSE_ACTIVE_SESSION_ID 提供 fallback；关闭时为空，避免对不存在会话发请求
+  const [activeSessionId, setActiveSessionId] = useState<string>(() => loadActiveSessionId());
 
   // 全局角色库与人员名单状态 (支持动态增删改与持久化)
   const [roles, setRoles] = useState<RoleDefinition[]>(() => DEFAULT_ROLES);
@@ -199,11 +200,12 @@ export default function App() {
 
   const isAdmin = currentUser.roleId === 'role-admin';
 
-  // 获取当前激活会话的项目ID (默认为 1)
+  // 获取当前激活会话的项目ID；无有效会话时为 0（空态由 chatBlockedNoProject 分支承接，
+  // 不得回退到硬编码项目 ID——真实环境中该 ID 可能不存在，会产生 404/403 假请求）
   const currentProjectId = useMemo(() => {
     const activeSess = sessions.find((s) => s.sessionId === activeSessionId);
     const resolved = resolveSessionProjectId(activeSess);
-    return resolved > 0 ? resolved : 1;
+    return resolved > 0 ? resolved : 0;
   }, [sessions, activeSessionId]);
 
   // 获取当前项目与当前用户在其中的成员职责