Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/web/src/components/AppSidebar.tsx

@@ -0,0 +1,119 @@
+/**
+ * The left navigation pane.
+ *
+ * One component for both treatments the sidebar primitive provides: the
+ * collapsible desktop rail and the phone Sheet. Deliberately not two, because
+ * the previous shell had the desktop list and the tab bar as separate JSX and
+ * they had already drifted — the tab bar's active pill and the sidebar's
+ * active row used different tokens.
+ */
+import { X } from 'lucide-react';
+import { Link, useMatch, useResolvedPath } from 'react-router-dom';
+import { useIdentity } from '@/lib/identity';
+import { NAV_GROUPS, visibleNav, type NavItem } from '@/lib/nav';
+import { AccountSwitcher } from './AccountSwitcher';
+import { Button } from './ui';
+import {
+  Sidebar,
+  SidebarContent,
+  SidebarGroup,
+  SidebarGroupContent,
+  SidebarGroupLabel,
+  SidebarHeader,
+  SidebarMenu,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarRail,
+  SidebarSeparator,
+  useSidebar,
+} from './ui/sidebar';
+
+export function AppSidebar() {
+  const identity = useIdentity();
+  const items = visibleNav(identity);
+  const { isMobile, setOpenMobile } = useSidebar();
+
+  return (
+    <Sidebar collapsible="icon">
+      <SidebarHeader>
+        {/* The Sheet's own close button is suppressed because it lands on top
+            of the account switcher. This one replaces it — Escape and the
+            overlay work, but a visible close is not optional on a touch
+            device where neither is discoverable. */}
+        {isMobile ? (
+          <div className="flex items-center justify-between pl-2">
+            <span className="text-[10px] font-semibold uppercase tracking-[0.16em] text-muted">
+              Navigate
+            </span>
+            <Button
+              type="button"
+              variant="ghost"
+              size="icon"
+              className="text-muted"
+              aria-label="Close navigation"
+              onClick={() => setOpenMobile(false)}
+            >
+              <X className="size-5" aria-hidden />
+            </Button>
+          </div>
+        ) : null}
+        <AccountSwitcher />
+      </SidebarHeader>
+      <SidebarSeparator />
+      <SidebarContent>
+        {NAV_GROUPS.map((group) => {
+          const groupItems = items.filter((item) => item.group === group);
+          // A heading over nothing is worse than a missing section: it reads
+          // as a section that failed to load rather than one you cannot use.
+          if (!groupItems.length) return null;
+          return (
+            <SidebarGroup key={group}>
+              <SidebarGroupLabel>{group}</SidebarGroupLabel>
+              <SidebarGroupContent>
+                <SidebarMenu>
+                  {groupItems.map((item) => (
+                    <NavItemRow key={item.to} item={item} />
+                  ))}
+                </SidebarMenu>
+              </SidebarGroupContent>
+            </SidebarGroup>
+          );
+        })}
+      </SidebarContent>
+      {/*
+        No footer. The old shell ended with "Prime Intellect Growth / Compute
+        revenue system", which the account switcher at the top now says
+        better — and at 900px the fourteen nav rows do not all fit, so a
+        restatement of the workspace name was costing two of them.
+      */}
+      <SidebarRail />
+    </Sidebar>
+  );
+}
+
+function NavItemRow({ item }: { item: NavItem }) {
+  const { setOpenMobile, isMobile } = useSidebar();
+  // `asChild` renders the row *as* the link rather than wrapping one, so there
+  // is a single focusable element per row. Active state is asked of the router
+  // instead of compared against a pathname, so `/demand/abc` still lights
+  // Demand and `/` does not light everything.
+  const resolved = useResolvedPath(item.to);
+  const isActive = useMatch({ path: resolved.pathname, end: item.to === '/' }) !== null;
+
+  return (
+    <SidebarMenuItem>
+      <SidebarMenuButton asChild isActive={isActive} tooltip={item.label}>
+        <Link
+          to={item.to}
+          aria-current={isActive ? 'page' : undefined}
+          onClick={() => {
+            if (isMobile) setOpenMobile(false);
+          }}
+        >
+          <item.icon aria-hidden />
+          <span>{item.label}</span>
+        </Link>
+      </SidebarMenuButton>
+    </SidebarMenuItem>
+  );
+}