[Bug report] V2 Web UI fetches metalakes before OIDC authentication bootstrap completes

[vanphuoc3012]

Version

main branch

Describe what's wrong

When using OIDC/OAuth authentication in the V2 Web UI, the metalakes page can request metalake data before the authentication bootstrap finishes.

The auth provider resolves the auth type, obtains the OIDC access token, fetches the server-resolved principal from /api/authn/me, and then updates Redux auth state. However, the
metalakes page currently fetches metalakes as soon as the page mounts. This can race with OIDC bootstrap.

As a result, the UI may send requests before authType, authToken, or authUser are ready. Depending on timing, this can cause unauthorized requests, redirects back to login, refresh
loops, or an empty/loading metalakes page after OIDC login.

Expected behavior

The V2 Web UI should not fetch metalakes until OIDC authentication bootstrap is complete.

For OAuth/OIDC mode, the metalakes page should wait until the user is authenticated before sending metalake API requests.

Error message and/or stacktrace

No consistent stacktrace. The symptom is timing-dependent.

Possible symptoms:

• The V2 Web UI redirects back to login after OIDC login.
• The metalakes page refreshes or reloads unexpectedly.
• The metalakes list does not load after successful OIDC login.
• API requests are sent before the OIDC token is ready.

How to reproduce

1. Configure Gravitino with OIDC/OAuth authentication:

   gravitino.authenticators = oauth                                                                                                                                                        
   gravitino.authenticator.oauth.provider = oidc                                                                                                                                           
   gravitino.authenticator.oauth.clientId = <client-id>                                                                                                                                    
   gravitino.authenticator.oauth.authority = <oidc-authority>                                                                                                                              
   gravitino.authenticator.oauth.scope = openid profile email                                                                                                                              
   gravitino.authenticator.oauth.principalFields = preferred_username,email,sub                                                                                                            

2. Start Gravitino with V2 Web UI enabled.    
3. Open the V2 Web UI.                        
4. Login through the OIDC provider.           
5. Observe that the metalakes page can issue metalake API requests before OAuth bootstrap completes.  

### Additional context

web-v2/web/src/app/metalakes/page.js fetches metalakes immediately when the page mounts:      

```js                                         
  useEffect(() => {                           
    dispatch(resetMetalakeStore())            
    dispatch(fetchMetalakes())                
  }, [dispatch])                              

For OIDC/OAuth, authentication is initialized asynchronously in:

  web-v2/web/src/lib/provider/session.js      

The provider needs to:

1. Fetch auth configs.
2. Detect authType === 'oauth'.
3. Get the OIDC access token.
4. Fetch /api/authn/me.
5. Dispatch setAuthToken, setAuthUser, and authenticated/bootstrap state.

The metalakes page does not wait for this bootstrap to finish before calling fetchMetalakes().