Feat v0.7.0 shell contract + surface audit + rebrand

Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/teams.go

@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"net/http"
 	"strconv"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"armature/crypto"
 	"armature/database"
+	"armature/events"
 	"armature/models"
 	"armature/store"
 )
@@ -44,12 +46,30 @@ type updateMemberRequest struct {
 type TeamHandler struct{
 	stores store.Stores
 	vault  *crypto.KeyResolver
+	hub    *events.Hub
 }
 
 func NewTeamHandler(s store.Stores, vault *crypto.KeyResolver) *TeamHandler {
 	return &TeamHandler{stores: s, vault: vault}
 }
 
+// SetHub attaches the event hub for auth change notifications.
+func (h *TeamHandler) SetHub(hub *events.Hub) {
+	h.hub = hub
+}
+
+// notifyAuthChanged sends an auth.changed event to a specific user.
+func (h *TeamHandler) notifyAuthChanged(userID, reason string) {
+	if h.hub == nil {
+		return
+	}
+	h.hub.PublishToUser(userID, events.Event{
+		Label:   "auth.changed",
+		Payload: events.MustJSON(map[string]string{"reason": reason}),
+		Ts:      time.Now().UnixMilli(),
+	})
+}
+
 // ── Admin: List All Teams ───────────────────
 
 func (h *TeamHandler) ListTeams(c *gin.Context) {
@@ -278,6 +298,7 @@ func (h *TeamHandler) AddMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusCreated, gin.H{"id": id})
+	h.notifyAuthChanged(req.UserID, "team_member_added")
 	AuditLog(h.stores.Audit, c, "team.add_member", "team", getTeamID(c), map[string]interface{}{
 		"user_id": req.UserID, "role": req.Role,
 	})
@@ -312,6 +333,9 @@ func (h *TeamHandler) UpdateMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	if uid := h.memberUserID(c.Request.Context(), teamID, memberID); uid != "" {
+		h.notifyAuthChanged(uid, "team_role")
+	}
 	AuditLog(h.stores.Audit, c, "team.update_member", "team", getTeamID(c), map[string]interface{}{
 		"member_id": memberID, "role": req.Role,
 	})
@@ -323,6 +347,9 @@ func (h *TeamHandler) RemoveMember(c *gin.Context) {
 	teamID := getTeamID(c)
 	memberID := c.Param("memberId")
 
+	// Look up user_id before delete for auth notification
+	affectedUID := h.memberUserID(c.Request.Context(), teamID, memberID)
+
 	n, err := h.stores.Teams.DeleteMemberByID(c.Request.Context(), memberID, teamID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
@@ -334,6 +361,9 @@ func (h *TeamHandler) RemoveMember(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"ok": true})
+	if affectedUID != "" {
+		h.notifyAuthChanged(affectedUID, "team_member_removed")
+	}
 	AuditLog(h.stores.Audit, c, "team.remove_member", "team", getTeamID(c), map[string]interface{}{
 		"member_id": memberID,
 	})
@@ -467,9 +497,39 @@ func (h *TeamHandler) UpdateRoles(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, gin.H{"data": roles})
+	// Notify all team members — role definitions changed
+	h.notifyTeamMembers(c.Request.Context(), teamID, "team_roles_updated")
 	AuditLog(h.stores.Audit, c, "team.update_roles", "team", teamID, map[string]interface{}{"roles": roles})
 }
 
+// memberUserID looks up the user_id for a team member by row ID.
+func (h *TeamHandler) memberUserID(ctx context.Context, teamID, memberID string) string {
+	members, err := h.stores.Teams.ListMembers(ctx, teamID)
+	if err != nil {
+		return ""
+	}
+	for _, m := range members {
+		if m.ID == memberID {
+			return m.UserID
+		}
+	}
+	return ""
+}
+
+// notifyTeamMembers sends an auth.changed event to all members of a team.
+func (h *TeamHandler) notifyTeamMembers(ctx context.Context, teamID, reason string) {
+	if h.hub == nil {
+		return
+	}
+	members, err := h.stores.Teams.ListMembers(ctx, teamID)
+	if err != nil {
+		return
+	}
+	for _, m := range members {
+		h.notifyAuthChanged(m.UserID, reason)
+	}
+}
+
 // getTeamRoles reads the roles array from team settings, falling back to builtins.
 func getTeamRoles(ctx context.Context, stores store.Stores, teamID string) []string {
 	team, err := stores.Teams.GetByID(ctx, teamID)