Feat v0.7.10 workflow handoff + assignment UI

Public→team stage handoff with audience mismatch detection, enriched
assignment API responses (workflow_name, stage_name, sla_breached),
team inbox with claim/assign actions, assignment notifications, team
middleware system-admin bypass fix, and SDK gap closure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/pages.go

@@ -646,6 +646,7 @@ type WorkflowPageData struct {
 	BrandingJSON         string
 	InstanceID           string // workflow instance ID (used for API calls)
 	Status               string // pending | active | completed | cancelled | stale
+	AudienceMismatch     bool   // true when current stage audience is team/system but visitor is unauthenticated
 }
 
 // WorkflowLandingPageData is passed to workflow-landing.html.
@@ -745,6 +746,22 @@ func (e *Engine) RenderWorkflow() gin.HandlerFunc {
 			entryToken = *inst.EntryToken
 		}
 
+		// Detect audience mismatch: stage requires team/system but visitor is
+		// unauthenticated. Show a "submitted" screen instead of the stage form.
+		audienceMismatch := false
+		userID := c.GetString("user_id")
+		if userID == "" {
+			// Visitor is unauthenticated — check the current stage audience
+			for _, s := range stages {
+				if s.ID == inst.CurrentStage || s.Name == inst.CurrentStage {
+					if s.Audience == models.AudienceTeam || s.Audience == models.AudienceSystem {
+						audienceMismatch = true
+					}
+					break
+				}
+			}
+		}
+
 		e.Render(c, "workflow.html", PageData{
 			Surface:      "workflow",
 			InstanceName: instanceName,
@@ -763,6 +780,7 @@ func (e *Engine) RenderWorkflow() gin.HandlerFunc {
 				BrandingJSON:        brandingJSON,
 				InstanceID:          inst.ID,
 				Status:              inst.Status,
+				AudienceMismatch:    audienceMismatch,
 			},
 		})
 	}