Rebuild the shell, add Calendar and Learn, and govern reads

Seven parallel agents and an adversarial verification pass. The three things
worth knowing before reading the diff:

RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is
stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago.
So this does not rebuild them; it closes the gaps an audit found. The big one
is that reads were entirely ungoverned: every GET was "any authenticated
member", so a junior demand rep and a research contractor could both pull
per-block supplier cost and break-even prices from /api/capacity/margin, and
every contract's negotiated terms. For a company whose margin is the business,
that was the hole that mattered. Adds book:read / economics:read / team:read,
a readGuard middleware, and a `viewer` role below member.

THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen.
Contracts.tsx never called can() at all, so its save button was always enabled
against a server requiring contract:sign; Capacity.tsx gated commitment
creation on deal:write/demand while the server wanted commitment:write/supply.

POST /api/activities was the one write bypassing executeMutation: no capability
check, and any member could mutate accounts.lastActivityAt as a side effect.
It is now a proper mutation() behind activity:write.

The shell becomes three panes — a collapsible shadcn sidebar with an account
switcher on the Piggy accent, a header with real search, and Piggy docked to
the right, page-aware and persistent across navigation. The phone keeps its
bottom tab bar, which is the thing this product already beat trycompai/crm on,
and gains the sidebar as a sheet.

Calendar is a projection over thirteen dated sources rather than a new table,
because a table would duplicate dates that already live on contracts, deals and
commitments and would drift — and one ledger answering the question is the
whole argument. It surfaces export_authorizations and compliance_artifacts,
which had indexed expires_at columns, schema comments saying they must be
alerted on, and no read endpoint or UI anywhere.

Learn carries two tracks. Concepts are members-only; the platform track can be
opened with a share code by someone with no account. The code mints a scoped
learn-only token and never a Principal — every route here resolves a principal
and then checks capabilities, so a principal-minting code would be one missing
check away from leaking the book. "Only platform-track rows may be code-visible"
is a database CHECK constraint as well as a write-path rule, and a test asserts
a valid learn token still gets 401 on /api/dashboard, /api/accounts and
/api/contracts — the same invariant scripts/deploy.sh refuses to ship without.

CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a
release-* tag and cloud-2 pulls it, so no credential on the shared runner can
execute anything on production — by construction rather than by policy. Both
halves of deploy.sh's original rule survive: nothing on the runner reaches the
host, and a human still decides when it ships. deploy.sh gains a rollback and a
public-origin check, and PIG_IMAGE now reaches compose through `sudo env`,
without which sudo's env_reset silently resolved every release to pig:local.

Tests 141 -> 261.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/web/src/lib/nav.ts

@@ -0,0 +1,109 @@
+/**
+ * The navigation table.
+ *
+ * Lifted out of Shell.tsx because four things now read it — the sidebar, the
+ * phone tab bar, the command palette and the header's page title — and a table
+ * that four consumers each filter differently is a table that ends up
+ * duplicated.
+ *
+ * Visibility is a *capability* question, not a cosmetic one. The convention in
+ * this codebase is to disable a control rather than hide it, so that the
+ * interface tells you the same story regardless of who you are. Navigation is
+ * the exception: a destination someone cannot use is not a disabled control,
+ * it is a page that answers 403, and offering it is worse than omitting it.
+ */
+import {
+  Boxes,
+  Building2,
+  CalendarClock,
+  FileSpreadsheet,
+  FileText,
+  GraduationCap,
+  LayoutDashboard,
+  MessageCircleMore,
+  Server,
+  Settings,
+  ShieldCheck,
+  Target,
+  TrendingUp,
+  Users,
+  type LucideIcon,
+} from 'lucide-react';
+import type { Capability, Team } from '@pig/core';
+import { canAny, type PermissionIdentity } from './permissions';
+
+export const NAV_GROUPS = ['Intelligence', 'Marketplace', 'Records', 'Control'] as const;
+export type NavGroup = (typeof NAV_GROUPS)[number];
+
+export interface NavItem {
+  to: string;
+  label: string;
+  icon: LucideIcon;
+  shortcut?: string;
+  group: NavGroup;
+  /** Shown in the phone tab bar. Space there is scarce, so only five fit. */
+  primary?: boolean;
+  /**
+   * Hide the item unless this capability is granted somewhere. Absent means
+   * the page is readable by any member — which includes Settings, where the
+   * appearance controls and Sign out live for everybody, admin or not.
+   */
+  requires?: Capability;
+  /** Narrows `requires` to one team, where the API enforces one. */
+  requiresTeam?: Team;
+}
+
+export const NAV: NavItem[] = [
+  { to: '/', label: 'Overview', icon: LayoutDashboard, group: 'Intelligence', primary: true },
+  { to: '/growth', label: 'Growth', icon: Target, group: 'Intelligence' },
+  { to: '/calendar', label: 'Calendar', icon: CalendarClock, group: 'Intelligence' },
+  { to: '/piggy', label: 'Piggy', icon: MessageCircleMore, group: 'Intelligence' },
+  { to: '/learn', label: 'Learn', icon: GraduationCap, group: 'Intelligence' },
+  { to: '/margin', label: 'Margin', icon: TrendingUp, group: 'Intelligence', primary: true },
+  { to: '/capacity', label: 'Capacity', icon: Server, group: 'Marketplace', primary: true },
+  { to: '/demand', label: 'Demand', icon: Building2, group: 'Marketplace', primary: true },
+  { to: '/supply', label: 'Supply', icon: Boxes, group: 'Marketplace', primary: true },
+  { to: '/accounts', label: 'Accounts', icon: Building2, group: 'Records' },
+  { to: '/contracts', label: 'Contracts', icon: FileText, group: 'Records' },
+  {
+    to: '/imports',
+    label: 'Import',
+    icon: FileSpreadsheet,
+    group: 'Records',
+    requires: 'data:import',
+  },
+  { to: '/team', label: 'Team', icon: Users, group: 'Control' },
+  {
+    to: '/facts',
+    label: 'Fact review',
+    icon: ShieldCheck,
+    group: 'Control',
+    // The API gates fact review on data:import for the research team
+    // specifically (routes/facts.ts), so the nav has to ask the same question.
+    requires: 'data:import',
+    requiresTeam: 'research',
+  },
+  { to: '/settings', label: 'Settings', icon: Settings, group: 'Control' },
+];
+
+export function visibleNav(identity: PermissionIdentity | undefined): NavItem[] {
+  return NAV.filter((item) => {
+    if (!item.requires) return true;
+    if (!item.requiresTeam) return canAny(identity, item.requires);
+    return Boolean(
+      identity &&
+        identity.permissions.some(
+          (grant) =>
+            grant.capability === item.requires &&
+            (grant.team === null || grant.team === item.requiresTeam),
+        ),
+    );
+  });
+}
+
+/** The nav entry a pathname belongs to, for the header title and active state. */
+export function activeNavItem(items: readonly NavItem[], pathname: string): NavItem | undefined {
+  return items.find((item) =>
+    item.to === '/' ? pathname === '/' : pathname === item.to || pathname.startsWith(`${item.to}/`),
+  );
+}