feat(frontend): organization management UI + role-aware permission gating (stacked on #267)

[amal66]

Stacked on #267

This PR is the frontend half of the organizations/RBAC feature: it sits on top of #267's branch and carries its two commits — review the top commit only (feat(frontend): organization management UI + role-aware permission gating). If #267 merges first, this rebases to a single clean commit.

#267 shipped the tenant layer and the project role ladder server-side, but nothing in the product surfaced it: no way to create an org, no way to see members, and a UI that still derives every permission from a single is_owner boolean (including the org-admin case where the server allows an action but the client renders read-only). This PR closes those UI/UX flows.

What it adds

Settings → Organizations (new page, plus a sidebar entry)

• Create an organization (you become its owner). The auto-provisioned personal org is deliberately hidden — it's plumbing, not a firm.
• Member roster per org: profile display names/emails (never bare user ids), role badges, a role select (owner/admin/member) for owners/admins, remove-member and leave-org with confirmation. Server rules surface inline — including the 409 An organization must keep at least one owner. last-owner protection.
• Teams: create/delete teams, add/remove members by email, member chips with profile names.
• Plain members see the roster read-only — no add input, no role selects — matching the server's authorization.

Org-scoped project creation

The New Project modal gains an Organization select (default: Personal workspace) populated from GET /orgs. This is the write path that makes the whole feature real: until now nothing in the UI could create a project with an org_id.

Role-aware permission gating (replaces is_owner-only logic)

frontend/src/app/lib/permissions.ts mirrors the server's capability matrix, and detail pages derive the caller's role from the access_role field #267 added (falling back to the historic is_owner contract on list rows). One canDo(capability) seam threads through the project workspace:

Surface	Now gated by
Project details edit, sharing (PeopleModal write mode)	members.manage (manager+)
Folder rename / move / delete, incl. drag-and-drop	structure.manage (manager+)
Folder create, document rename / move / remove-from-folder	docs.organize (editor+)
Document upload / Add-documents action	content.edit (editor+)
Review columns, document set, clear-cells, details, apply-workflow	structure.manage (manager+)
Project / review delete	owner only

Notable fixes this delivers:

• The folder tree was previously completely unguarded — any shared member saw working rename/delete affordances whose server calls now fail; viewers saw them too. Gated with the same popup pattern used everywhere else.
• Org admins are no longer shown a read-only project they can actually manage (the server-allows/client-forbids inconsistency).
• OwnerOnlyPopup grows a requiredRole tier ("Only the owner or a manager can rename folders.") and now shows the owner's email when known, so a denial tells the user who to ask.
• Review details save only sends project_id when it actually changed — moving a review is owner-only server-side, and a manager editing just the title must not 403.

Backend (small, additive)

GET /orgs/:orgId/members and GET /orgs/:orgId/teams are enriched with mirrored profile email/display_name (same source as the projects /people endpoint) so the client never has to render a UUID.

UX walkthrough (screenshots)

Captured against a live local stack (Supabase CLI + MinIO + backend + prod next start), three users in one org: an owner, an admin (→ manager role on org projects), and a plain member (→ viewer).

As the org owner

1 — Organization management (Settings → Organizations): roster with role selects and descriptions, teams with member chips.

2 — Creating a project inside the firm: the new Organization select in the New Project modal.

3 — Owner's project view: full toolset (Folder, Add documents, Actions).

4 — People with access modal.

As a plain org member (viewer)

5 — Same project, read-only: no Folder button, Add documents disabled.

6 — "View details": inputs disabled.

7 — Delete attempt: owner-only popup instead of a silent 404.

As an org admin (manager)

8 — Manager toolset: Folder and uploads available — the previous server-allows/client-forbids inconsistency is gone.

9 — "Edit details": editable, with Update action.

10 — Container deletion still owner-only, even for admins.

Testing

• cd frontend && npm test → 74 passed (10 files), including new suites: the client capability matrix asserted cell-by-cell against the server's, the roleFrom fallback contract, OrganizationsPage flows (create org, roster rendering, role change, inline 409 surfacing, member read-only mode), and OwnerOnlyPopup tier copy.
• cd frontend && npx tsc --noEmit → clean; npm run lint → 0 errors; next build → clean production build.
• cd backend && npx vitest run → 307 passed (member/team enrichment covered by the orgs service suite).
• Manually verified against a full local stack (Supabase CLI + MinIO + backend + prod next start): org create → member add → role change → viewer/editor/manager gating in the project and review UIs.

Provenance

All new code written for this PR (no fork port — the fork has no org UI). Follows the existing conventions: account settings tab rail, AccountSection glass cards, PillButton/ModalSelect/AddUserInput primitives, apiRequest client layer, the OwnerOnlyPopup guard idiom, and testing-library patterns from the frontend harness.

🤖 Generated with Claude Code

[amal66]

Went through the full diff — the core feature here is solid, but the PR bundles several independent changes worth calling out. Breakdown:

1. Backend pagination/search/sort (the stated scope)

• New 9-arg get_tabular_reviews_overview RPC (p_scope, p_limit, p_offset, p_search_term, p_sort_key, p_sort_direction), with the legacy 3-arg signature kept as a compatibility wrapper
• Small parsing/validation libs (pagination.ts, search.ts, sort.ts, tabularReviewsOverview.ts) and the tabular.ts route wiring

2. Frontend lazy-load integration

• usePaginatedTabularReviews hook (debounced search via useDebouncedValue, abort-on-query-change, retry), wired into both tabular-reviews pages and ProjectReviewsTable
• mikeApi.ts client support for the new args

3. Perf/schema work inside the migration that goes beyond pagination

• document_count computed once in a new review_document_counts CTE, avoiding recomputation in the new sort branches
• tabular_cells aggregation narrowed to only reviews whose document_ids isn't a JSON array
• pg_trgm extension + GIN trigram index on lower(title) (supports the new search, but it's schema surface of its own)

4. State-management removal in ProjectWorkspace

• Deletes the entire projectReviews cache: state, loading flag, ensureProjectReviews, its promise ref, the prefetch call, and the optimistic prepend after creating a review
• Consequence: reviews are refetched on every visit to the reviews tab instead of cached in the workspace context

5. Shared PageHeader search-control UX change (cross-cutting — affects every page with a header search, not just tabular reviews)

• Adds a clear (✕) button
• Input stays expanded whenever it has a value
• Outside click no longer clears the query (previously it wiped it)
• autoFocus only on explicit open
• Regression: the input lost its disabled={disabled} — only the clear button is disabled now, so a disabled search still accepts typing

6. Drive-by logic fix in delete-selected (both pages)

• Owned-ids filter flipped from !review || review.user_id === user.id to !!review && review.user_id === user.id — selected ids not present in the loaded list are no longer assumed deletable. Good catch on a real pre-existing bug, just worth noting it's unrelated to pagination.

Tests (supporting #1–#2)

• 4 backend unit-test files (pagination, search, sort, RPC-args parsers)
• New Supabase integration test (tied-row pagination determinism, scope+search-before-limit, sort-before-paginate, legacy 3-arg RPC still callable), registered in test-stack.sh
• Hook tests (selection scoping, abort-on-query-change, error + retry)

---

Requested changes:

1. Split the PageHeader change (fix: JSONB array queries fail with "invalid input syntax for type json" #5) into its own PR. It silently changes search behavior on every page that uses the shared header, so it needs its own review — this PR should stay focused on the pagination approach, which is the part that needs design sign-off before being mirrored to the other views.
2. Restore disabled={disabled} on the search input (in whichever PR ends up carrying fix: JSONB array queries fail with "invalid input syntax for type json" #5) — right now a disabled search still accepts typing.
3. Mention Is Mike aimed at any specific territory? #3, Create Docker file and / or compose for easy deployment #4, and feat(research): add Olostep web research endpoints #6 in the PR description if you'd rather keep them here than split them too — they're reasonable changes, but as written the description doesn't cover them, and future readers of this PR won't know they shipped with it.

Happy to re-review quickly once that's done — #1 + #2 + the tests look good and I don't expect issues with the core approach.