Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/api/test/helpers/principal.ts

@@ -0,0 +1,105 @@
+/**
+ * Shared test fixtures for authorisation.
+ *
+ * Before this, `Principal` was re-declared as a literal in auth.test.ts,
+ * records.test.ts, mutation.test.ts and half a dozen others — ten copies of the
+ * same nine fields. Adding a field to `Principal` meant editing every one of
+ * them, and the copies had already drifted on `scopes`, which is precisely the
+ * field the read/write split now turns on. One factory, overridden per case.
+ */
+import type { Team, TeamRole } from '@pig/core';
+import type { Database } from '@pig/db';
+import type { Principal } from '../../src/lib/auth';
+
+/**
+ * A demand-team member with a full-scope session: the ordinary user, chosen as
+ * the default because it is the case most tests want to vary *away* from.
+ */
+export function principal(overrides: Partial<Principal> = {}): Principal {
+  return {
+    userId: '00000000-0000-4000-8000-000000000001',
+    email: 'seller@example.com',
+    name: 'Seller',
+    isPlatformAdmin: false,
+    teams: [{ team: 'demand', role: 'member' }],
+    via: 'jwt',
+    scopes: ['read', 'write'],
+    ...overrides,
+  };
+}
+
+/** One membership, spelled out — the common override, and easy to get wrong. */
+export function onTeam(team: Team, role: TeamRole): Partial<Principal> {
+  return { teams: [{ team, role }] };
+}
+
+export interface FakeDatabaseOptions {
+  /** Appended to in call order, so a test can assert what ran and in what order. */
+  events?: string[];
+  /** Rows handed to `insert().values()`, chiefly the audit activity. */
+  inserted?: unknown[];
+  /** Rows a `select()` chain resolves to. Defaults to empty. */
+  selected?: unknown[];
+}
+
+/**
+ * The minimum Drizzle surface `executeMutation` touches: a transaction, an
+ * insert that records its row, and a select chain that resolves to fixed rows.
+ * Deliberately not a database — a test that needs real SQL semantics needs a
+ * real Postgres, and pretending otherwise is how a fake starts asserting that
+ * broken queries work.
+ */
+export function fakeDatabase(options: FakeDatabaseOptions = {}): Database {
+  const events = options.events ?? [];
+  const inserted = options.inserted ?? [];
+  const selected = options.selected ?? [];
+
+  const selectChain = {
+    from: () => selectChain,
+    leftJoin: () => selectChain,
+    innerJoin: () => selectChain,
+    where: () => selectChain,
+    orderBy: () => selectChain,
+    limit: async () => selected,
+    then: (resolve: (rows: unknown[]) => unknown) => resolve(selected),
+  };
+
+  const insertChain = {
+    values: (row: unknown) => {
+      events.push('insert');
+      inserted.push(row);
+      return {
+        onConflictDoNothing: () => ({ returning: async () => [row] }),
+        returning: async () => [row],
+        then: (resolve: (value: unknown) => unknown) => resolve(undefined),
+      };
+    },
+  };
+
+  const updateChain = {
+    set: () => ({
+      where: async () => {
+        events.push('update');
+      },
+    }),
+  };
+
+  const tx = {
+    select: () => {
+      events.push('select');
+      return selectChain;
+    },
+    insert: () => insertChain,
+    update: () => updateChain,
+  };
+
+  return {
+    transaction: async (work: (transaction: unknown) => Promise<unknown>) => {
+      events.push('transaction');
+      return work(tx);
+    },
+    select: tx.select,
+    insert: tx.insert,
+    update: tx.update,
+  } as unknown as Database;
+}