Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/api/src/routes/imports.ts

@@ -1,8 +1,8 @@
-import { IMPORT_ENTITIES, IMPORT_ENTITY_DEFINITIONS } from '@pig/core';
+import { IMPORT_ENTITIES, IMPORT_ENTITY_DEFINITIONS, type ImportEntity, type Team } from '@pig/core';
 import type { Database } from '@pig/db';
 import { Hono } from 'hono';
 import { z } from 'zod';
-import { requireCapability } from '../lib/auth';
+import { requireAnyTeamCapability, requireCapability } from '../lib/auth';
 import type { ApiEnv, MutationDefinition } from '../lib/mutation';
 import { MutationError, mutation } from '../lib/mutation';
 import {
@@ -37,6 +37,39 @@ const parseSchema = z.object({
   base64: z.string().min(1).max(Math.ceil(MAX_IMPORT_FILE_BYTES * 4 / 3) + 16),
 }).strict();
 
+/**
+ * Which team's book an import writes into.
+ *
+ * The commit is the only point at which that is knowable, and it is the only
+ * point at which it matters: `requireCapability(p, 'data:import')` with no team
+ * passed if the principal held the capability on *any* team, so a research-team
+ * admin could rewrite the demand pipeline. Accounts and contacts are shared by
+ * both commercial sides, so admin of either is enough for those.
+ */
+export const IMPORT_ENTITY_TEAMS: Readonly<Record<ImportEntity, readonly Team[]>> = {
+  account: ['supply', 'demand'],
+  contact: ['supply', 'demand'],
+  demand_deal: ['demand'],
+  supply_deal: ['supply'],
+};
+
+function requireImportPermission(
+  principal: Parameters<typeof requireCapability>[0],
+  entity: ImportEntity,
+): void {
+  const teams = IMPORT_ENTITY_TEAMS[entity];
+  let denial: unknown;
+  for (const team of teams) {
+    try {
+      requireCapability(principal, 'data:import', team);
+      return;
+    } catch (error) {
+      denial = error;
+    }
+  }
+  throw denial;
+}
+
 interface ImportCommitOperations {
   commit(
     input: z.infer<typeof commitSchema>,
@@ -52,9 +85,13 @@ export function createImportCommitMutationDefinition(
 ): MutationDefinition<typeof commitSchema, ImportCommitResult> {
   return {
     schema: commitSchema,
-    permission: { authorize: (principal) => requireCapability(principal, 'data:import') },
+    // Two stages: any-team up front so a principal with no import authority at
+    // all cannot probe the schema, then the entity's own team once the body has
+    // been parsed and the target is finally knowable.
+    permission: { authorize: (principal) => requireAnyTeamCapability(principal, 'data:import') },
     invalidMessage: 'Invalid import commit.',
     async mutate({ input, principal, tx, now }) {
+      requireImportPermission(principal, input.entity);
       const result = await makeService(tx).commit(input, principal, now);
       const entityLabel = IMPORT_ENTITY_DEFINITIONS[input.entity].label.toLocaleLowerCase();
       return {
@@ -78,8 +115,21 @@ export function createImportCommitMutationDefinition(
 
 export function createImportRoutes(db: Database): Hono<ApiEnv> {
   const routes = new Hono<ApiEnv>();
+  // Any team, deliberately: config, parse and preview touch no book at all —
+  // preview is a dry run against uploaded cells. The commit is where the team
+  // is enforced, because the commit is where rows are written.
+  //
+  // The nested integration namespaces are skipped rather than left to fall
+  // through this. They are mounted after this router, so Hono runs this
+  // middleware for them too, and it would have re-imposed `data:import` on the
+  // OAuth routes that were just split onto `integration:connect` — the split
+  // would have compiled, passed its unit tests, and changed nothing.
   routes.use('/api/imports/*', async (context, next) => {
-    requireCapability(context.get('principal'), 'data:import');
+    const path = new URL(context.req.url).pathname;
+    if (path.startsWith('/api/imports/google/') || path.startsWith('/api/imports/notion/')) {
+      return next();
+    }
+    requireAnyTeamCapability(context.get('principal'), 'data:import');
     await next();
   });
   routes.get('/api/imports/config', (context) => context.json({