Feat v0.7.0 shell contract + surface audit + rebrand

Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/groups.go

@@ -4,11 +4,13 @@ import (
 	"database/sql"
 	"errors"
 	"net/http"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"armature/auth"
 	"armature/database"
+	"armature/events"
 	"armature/models"
 	"armature/notifications"
 	"armature/store"
@@ -43,12 +45,30 @@ type setResourceGrantRequest struct {
 
 type GroupHandler struct {
 	stores store.Stores
+	hub    *events.Hub
 }
 
 func NewGroupHandler(s store.Stores) *GroupHandler {
 	return &GroupHandler{stores: s}
 }
 
+// SetHub attaches the event hub for auth change notifications.
+func (h *GroupHandler) SetHub(hub *events.Hub) {
+	h.hub = hub
+}
+
+// notifyAuthChanged sends an auth.changed event to a specific user.
+func (h *GroupHandler) notifyAuthChanged(userID, reason string) {
+	if h.hub == nil {
+		return
+	}
+	h.hub.PublishToUser(userID, events.Event{
+		Label:   "auth.changed",
+		Payload: events.MustJSON(map[string]string{"reason": reason}),
+		Ts:      time.Now().UnixMilli(),
+	})
+}
+
 // ── Admin: List All Groups ──────────────────
 
 func (h *GroupHandler) ListGroups(c *gin.Context) {
@@ -249,6 +269,7 @@ func (h *GroupHandler) AddMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	h.notifyAuthChanged(req.UserID, "group_member_added")
 	AuditLog(h.stores.Audit, c, "group.member.add", "group", groupID, map[string]interface{}{
 		"user_id": req.UserID,
 	})
@@ -279,6 +300,7 @@ func (h *GroupHandler) RemoveMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	h.notifyAuthChanged(userID, "group_member_removed")
 	AuditLog(h.stores.Audit, c, "group.member.remove", "group", groupID, map[string]interface{}{
 		"user_id": userID,
 	})