Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/web/src/App.tsx

@@ -7,6 +7,9 @@ import { BrowserRouter, Route, Routes } from 'react-router-dom';
 import { Link } from 'react-router-dom';
 import { ApiError, get, getSupabase, loadPublicConfig, patch, type PublicConfig } from '@/lib/api';
 import { ThemeProvider } from '@/lib/theme';
+import { IdentityProvider, useIdentityQuery } from '@/lib/identity';
+import { LayoutProvider } from '@/lib/layout';
+import { PiggyContextProvider } from '@/lib/piggy-context';
 import { Shell } from '@/components/Shell';
 import { SignIn } from '@/pages/SignIn';
 import { CreateProfile } from '@/pages/CreateProfile';
@@ -29,6 +32,8 @@ const Contracts = lazy(() => import('@/pages/Contracts').then(({ Contracts }) =>
 const Imports = lazy(() => import('@/pages/Imports').then(({ Imports }) => ({ default: Imports })));
 const Piggy = lazy(() => import('@/pages/Piggy').then(({ Piggy }) => ({ default: Piggy })));
 const Growth = lazy(() => import('@/pages/Growth').then(({ Growth }) => ({ default: Growth })));
+const Calendar = lazy(() => import('@/pages/Calendar').then(({ Calendar }) => ({ default: Calendar })));
+const Learn = lazy(() => import('@/pages/Learn').then(({ Learn }) => ({ default: Learn })));
 
 const queryClient = new QueryClient({
   defaultOptions: {
@@ -103,19 +108,18 @@ function AuthGate({ config }: { config: PublicConfig }) {
   // that a half-filled registration form is not lost to an accidental Back.
   const [showRegister, setShowRegister] = useState(false);
 
-  const { data, isLoading, error, refetch } = useQuery({
-    queryKey: ['me'],
-    queryFn: () => get<{ id: string; name: string }>('/api/me'),
-  });
+  const { data, isLoading, error, refetch } = useIdentityQuery();
 
-  // Adopt the server's stored appearance preferences once we know who this is.
+  // Adopt the server's stored appearance once we know who this is. Appearance
+  // only: sidebar-collapsed and dock-open are per-device and live in
+  // localStorage, deliberately (see lib/layout.tsx).
   useEffect(() => {
     if (!data) return;
     void get<{ themeMode?: string; accentColor?: string }>('/api/me/profile')
       .then((profile) => {
-        const adopt = (window as unknown as { __pigAdoptTheme?: (p: unknown) => void })
-          .__pigAdoptTheme;
-        if (profile && adopt) adopt(profile);
+        if (!profile) return;
+        const host = window as unknown as { __pigAdoptTheme?: (p: unknown) => void };
+        host.__pigAdoptTheme?.(profile);
       })
       .catch(() => {});
   }, [data]);
@@ -134,6 +138,22 @@ function AuthGate({ config }: { config: PublicConfig }) {
 
   if (error instanceof ApiError) {
     if (error.needsSignIn) {
+      /*
+       * Learn is the one route reachable without an account. It gates itself on
+       * a share code, and the API only ever serves it platform-track rows — so
+       * sending a code-holder to the sign-in screen would make the code
+       * unusable, which is the whole point of having one.
+       *
+       * Rendered outside Shell deliberately: the page uses no identity, layout
+       * or dock hook, and there is no member to build a workspace chrome for.
+       */
+      if (window.location.pathname === '/learn') {
+        return (
+          <RoutePage>
+            <Learn />
+          </RoutePage>
+        );
+      }
       return showRegister ? (
         <Register
           config={config}
@@ -166,12 +186,26 @@ function AuthGate({ config }: { config: PublicConfig }) {
     );
   }
 
+  return (
+    <IdentityProvider identity={data}>
+      <LayoutProvider>
+        <PiggyContextProvider>
+          <AppRoutes />
+        </PiggyContextProvider>
+      </LayoutProvider>
+    </IdentityProvider>
+  );
+}
+
+function AppRoutes() {
   return (
     <Routes>
       <Route element={<Shell />}>
         <Route index element={<RoutePage><Overview /></RoutePage>} />
         <Route path="margin" element={<RoutePage><Margin /></RoutePage>} />
         <Route path="growth" element={<RoutePage><Growth /></RoutePage>} />
+        <Route path="calendar" element={<RoutePage><Calendar /></RoutePage>} />
+        <Route path="learn" element={<RoutePage><Learn /></RoutePage>} />
         <Route path="capacity" element={<RoutePage><Capacity /></RoutePage>} />
         <Route path="demand" element={<RoutePage><DemandPipeline /></RoutePage>} />
         <Route path="supply" element={<RoutePage><SupplyPipeline /></RoutePage>} />