fix: collapse GPU Service menu in Personal Org; add K8s-direct CTA

Two follow-ups to the GPU Service gating:

- In Personal-Org view the access extension was stripping
  canSeeAdmin/canSeeOrgAdmin but leaving canSeeGpuService at its
  admin-shortcut value, so platform admins switched into Personal
  still saw the menu even though Personal scope can't host a K8s
  cluster. Mirror the probe result through sessionStorage so the
  extension can fall back to the strict cluster-availability signal
  in that branch.

- The empty-state CTA now reads 'Add a Kubernetes Cluster' and, on
  click, opens the cluster-create flow with Kubernetes preselected
  via clusterSession.providerHint. ClusterCreate consumes the hint
  on mount: it seeds extraData.provider and starts at the configure
  step instead of the provider catalog, so the user lands one click
  closer to the form they actually need.

src/app.tsx

@@ -40,14 +40,31 @@ const checkDefaultPage = async (userInfo: any) => {
 // GPU Service (Kubernetes-only). Cheap (one list request) and never
 // blocks login — any failure just falls back to `undefined`, which
 // the predicate treats as "unknown / don't restrict beyond role".
+// The result is also mirrored into sessionStorage so access extensions
+// that run without the initialState argument can read it (e.g. to
+// override the admin shortcut in scopes where the menu shouldn't
+// show even for admins).
+const HAS_K8S_CLUSTER_KEY = 'hasKubernetesCluster';
 const probeHasKubernetesCluster = async (): Promise<boolean | undefined> => {
   try {
     const res = await queryClusterList({ page: -1 });
-    return (res?.items ?? []).some(
+    const value = (res?.items ?? []).some(
       (c) => c?.provider === ProviderValueMap.Kubernetes
     );
+    try {
+      window.sessionStorage.setItem(HAS_K8S_CLUSTER_KEY, JSON.stringify(value));
+    } catch {
+      // sessionStorage may be unavailable (Safari private mode); the
+      // access predicate already handles a missing value as "unknown".
+    }
+    return value;
   } catch (error) {
     console.error('probeHasKubernetesCluster error', error);
+    try {
+      window.sessionStorage.removeItem(HAS_K8S_CLUSTER_KEY);
+    } catch {
+      // ignore
+    }
     return undefined;
   }
 };