Feat v0.7.0 shell contract + surface audit + rebrand

Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -588,10 +588,12 @@ func main() {
 
 			// Teams (user: my teams)
 			teams := handlers.NewTeamHandler(stores, keyResolver)
+			teams.SetHub(hub)
 			protected.GET("/teams/mine", teams.MyTeams)
 
 			// Groups (user: my groups
 			groupH := handlers.NewGroupHandler(stores)
+			groupH.SetHub(hub)
 			protected.GET("/groups/mine", groupH.MyGroups)
 
 			// Team admin self-service
@@ -710,6 +712,7 @@ func main() {
 
 			// Teams (admin)
 			teamAdm := handlers.NewTeamHandler(stores, keyResolver)
+			teamAdm.SetHub(hub)
 			admin.GET("/teams", teamAdm.ListTeams)
 			admin.POST("/teams", teamAdm.CreateTeam)
 			admin.GET("/teams/:id", teamAdm.GetTeam)
@@ -730,6 +733,7 @@ func main() {
 
 			// Groups (admin
 			groupAdm := handlers.NewGroupHandler(stores)
+			groupAdm.SetHub(hub)
 			admin.GET("/groups", groupAdm.ListGroups)
 			admin.POST("/groups", groupAdm.CreateGroup)
 			admin.GET("/groups/:id", groupAdm.GetGroup)
@@ -789,6 +793,7 @@ func main() {
 			pkgAdm := handlers.NewPackageHandler(stores, packagesDir)
 			pkgAdm.SetSandbox(sandbox.New(sandbox.DefaultConfig()))
 			pkgAdm.SetBundledDir(cfg.BundledPackagesDir)
+			pkgAdm.SetHub(hub)
 
 			// Package registry — must be registered before /packages/:id
 			registryH := handlers.NewRegistryHandler(stores, packagesDir, pkgAdm)