Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/api/test/mutation.test.ts

@@ -1,45 +1,23 @@
 import { strict as assert } from 'node:assert';
 import { describe, it } from 'node:test';
 import { z } from 'zod';
-import type { Database } from '@pig/db';
-import type { Principal } from '../src/lib/auth';
 import { AuthError } from '../src/lib/auth';
 import { apiError, executeMutation, MutationError } from '../src/lib/mutation';
+import { fakeDatabase, onTeam, principal as makePrincipal } from './helpers/principal';
 
-const principal: Principal = {
-  userId: '00000000-0000-0000-0000-000000000001',
-  email: 'seller@example.com',
-  name: 'Seller',
-  isPlatformAdmin: false,
-  teams: [{ team: 'demand', role: 'member' }],
-  via: 'jwt',
-  scopes: ['read', 'write'],
-};
+const principal = makePrincipal();
 
-function fakeDatabase(events: string[], activityRows: unknown[]): Database {
-  const tx = {
-    insert: () => ({
-      values: async (row: unknown) => {
-        events.push('activity');
-        activityRows.push(row);
-      },
-    }),
-  };
-  return {
-    transaction: async (work: (transaction: unknown) => Promise<unknown>) => {
-      events.push('transaction');
-      return work(tx);
-    },
-  } as unknown as Database;
+function db(events: string[], inserted: unknown[] = []) {
+  return fakeDatabase({ events, inserted });
 }
 
 describe('mutation convention', () => {
   it('checks capability before reading attacker-controlled input', async () => {
     const events: string[] = [];
-    const forbidden = { ...principal, teams: [{ team: 'supply', role: 'admin' }] } as Principal;
+    const forbidden = makePrincipal(onTeam('supply', 'admin'));
 
     await assert.rejects(
-      executeMutation(fakeDatabase(events, []), forbidden, async () => {
+      executeMutation(db(events), forbidden, async () => {
         events.push('body');
         return {};
       }, {
@@ -61,7 +39,7 @@ describe('mutation convention', () => {
     const stages = ['qualification', 'legal'] as const;
 
     await assert.rejects(
-      executeMutation(fakeDatabase(events, []), principal, async () => ({ stage: 'invented' }), {
+      executeMutation(db(events), principal, async () => ({ stage: 'invented' }), {
         schema: z.object({ stage: z.enum(stages) }),
         permission: { capability: 'deal:write', team: 'demand' },
         invalidMessage: 'Invalid transition.',
@@ -82,7 +60,7 @@ describe('mutation convention', () => {
     const events: string[] = [];
     const rows: unknown[] = [];
     const result = await executeMutation(
-      fakeDatabase(events, rows),
+      db(events, rows),
       principal,
       async () => ({ stage: 'legal' }),
       {
@@ -105,7 +83,7 @@ describe('mutation convention', () => {
     );
 
     assert.deepEqual(result, { id: 'deal-1' });
-    assert.deepEqual(events, ['transaction', 'mutate', 'activity']);
+    assert.deepEqual(events, ['transaction', 'mutate', 'insert']);
     assert.deepEqual(rows, [
       {
         type: 'stage_change',