[RUM] Handled 403s step up ~20× — authenticated requests fire on / and /sign-in while signed out

## Summary

Handled `AxiosError: Request failed with status code 403` errors stepped up **~20×** in the last 24h, and are concentrated on the **signed-out** views (`/` and `/sign-in/`). This looks like authenticated background requests (operation polling, `/Login/`, org/cluster fetches) firing while the user has no valid session, each logged to the console → Datadog RUM.

Low user impact (they're *handled*), but it's meaningful RUM noise and points at background requests that shouldn't run while unauthenticated.

## Datadog RUM findings (last 24h vs prior 24h)

- **403 error volume:** ~9 (prior 24h) → **177** (last 24h), ~20× step-up. (Meanwhile 500s on the same operation endpoints dropped 123 → 4, so overall error mix shifted, not just grew.)
- **Distinct sessions with 403s:** 17. The `/Cluster/.../operation/` subset (the largest, 96 resource-events over 48h) is concentrated in **~2 users / 10 sessions**.
- **Error views:** `/` (86), `/sign-in/` (73), `/$organizationId/users/` (16), `/$organizationId/$clusterId/instances/` (8), rest scattered.
- **Failing endpoints (403 resource events, 24h):**
- `POST /Cluster/{id}/operation/` — 96
- `GET /Organization/{id}` — 15
- `POST /Login/` — 10
- `GET /Cluster/{id}` — 7
- `POST /HDBInstance/{id}/operation/` — ~30 across instances
- `GET /HarperVersions/` — 2
- **Handling stack:** mostly the axios interceptor `console.error`; ~16 originate from a TanStack Router `beforeLoad` → `preloadRoute` (route preload firing an authed request during a sign-in redirect).
- **App:** Studio RUM `f590deee-4bac-49b4-a202-3b6963d9721d`; observed on current deploy.

## Likely cause

Background/polling queries and route preloads (cluster & instance `operation` polling, org list, `HarperVersions`, `Login`) are firing on the `/` and `/sign-in/` views — i.e. after the session is gone / before it's established — and the server correctly returns 403. The router `beforeLoad` preload during the `sign-in?redirect=…` flow contributes a slice.

## Related (do not dupe)

- #1527 — 500s on the same instance/cluster `/operation` polling endpoints
- #1386 (closed) — persistent 401 on instance operation polling
- #1387 (closed) — TanStack Router preload race
- #1301 — race condition causing repeated sign-in prompts
- #1329 — clusters in a non-viewed org checked for login state

## Suggested next steps

- Gate operation-polling / org / version queries on an authenticated session (skip `enabled` while on `/sign-in` or without a session), so they don't fire → 403 → console.error while signed out.
- Consider not treating an expected 403-while-unauthenticated as a `console.error` (RUM noise reduction).

_Filed by the automated daily Datadog RUM review._

Trace the axios interceptor, TanStack Router beforeLoad/preloadRoute path, and the operation, organization, cluster, instance, version, and Login queries mentioned in the report. Reproduce the signed-out / and /sign-in/ flows, then verify that unauthenticated background requests no longer produce handled 403 console errors or RUM events.

Written by the indexing model from the issue text.