feat(web): per-Agent login, session identity & team management — web layer (HT-54) - #71

Types (Agent, SelfAgent, AuthProviderDescriptor) and typed functions
(getAuthProviders, postSetup, postVerify, getMe, listAgents,
createAgent, getAgent, patchAgent, deleteAgent, setAgentPassword,
resendInvite, acceptInvite) typed 1:1 against the engine branch's
src/api/agents.ts handlers, including the {agent}/{agents}/
{providers,needsSetup}/inviteSent wrapper shapes.

request() gains an internal actingAgent option: verifies the session
cookie via next/headers and attaches X-Helpthread-Agent-Id, throwing
a session-expired ApiError (no engine call) when there is no valid
session to assert. Per spec §8's pinned rule, the header rides on
every /agents/* call, /auth/me, and putAssignee — never on the
pre-session bootstrap endpoints or the other existing conversation
calls. A 401 that carried the header now gets a NEW SESSION_ERROR_DIGEST
(auth-error.ts) instead of AUTH_ERROR_DIGEST, so the two failure modes
("your session is stale" vs "the deployment's service token is bad")
route to different recoveries.

putAssignee's body becomes {assigneeAgentId} (was {assignee: 'me'|null})
— the breaking change specs/auth/agents-and-auth.md §10 calls out.
ConversationSummary.assigneeAgentId replaces the old assignee field.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…T-54)

loginAction/setupAction/acceptInviteAction call postVerify/postSetup/
acceptInvite and mint the session cookie from the returned Agent's id
— the engine is the sole verification authority now (scrypt hash-at-rest,
constant-time compare, no account enumeration, spec §4/§9). The
scryptSync/timingSafeEqual plaintext-env compare from HT-51 is deleted
along with the ~500ms failure delay: that delay blunted a scripted
guesser against a web-side plaintext compare that no longer exists: a
web-side sleep on top of the engine's own timing posture adds nothing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four new/extended public and shell surfaces (specs/auth/agents-and-auth.md
§7), each carrying LoginScreen's existing "NEW designed surface — requires
TJ fidelity sign-off" flag and reusing its two documented ds/ workarounds
(native password input, Button.requestSubmit()) rather than inventing new
ones:

- /setup (SetupScreen, public): name/email/password+confirm, zero-Agents-
  guarded — the page redirects to /login once an Agent already exists.
- /login (LoginScreen, extended): renders one email+password form per
  kind:'credentials' provider from GET /auth/providers; redirects to /setup
  when needsSetup.
- /invite/{token} (InviteAcceptScreen, public): set password + confirm;
  the engine's 401 (invalid/expired token) renders inline as a calm error
  — there's no separate token-validation endpoint to pre-check against.
- AppError.tsx gains a SessionExpired branch for SESSION_ERROR_DIGEST: signs
  out via the existing logoutAction (clears the cookie, redirects to
  /login) instead of showing AuthFailure's deployment-token copy, which
  would be the wrong story for a stale per-Agent session.

TopBar's avatar menu now shows the signed-in Agent's name/email/initials
(root layout.tsx fetches getMe(), swallowing a 401 the same way it already
swallows the notifications fetch — this layout has no error boundary above
it) and "Your profile" routes to /settings/team/{selfId}.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

/settings/team (admin-only UI; roster cards with initials, role chip,
invited/disabled badges, client-side search), /settings/team/new (role,
first/last name, email, invite-or-admin-password provisioning — "Send
an invite email" defaults on with "An invite can be sent later," an
admin-set password field appears only when it's off), and
/settings/team/{id} (name/timezone editable by self-or-admin, role and
Disabled toggle admin-only — Disabled hidden on self so an admin can't
lock themselves out here, change/reset password, resend invite while
invited, and Delete for admin-on-another using ConversationScreen's
two-step arm pattern, never confirm()).

A non-admin visiting /settings/team or /settings/team/new — or someone
else's /settings/team/{id} — is redirected to their own profile instead
of ever reaching the engine's 403: the simpler of the brief's two
options, and it keeps an engine 403 from ever rendering as a crash.

agent-actions.ts is the write path: unlike actions.ts's conversation
mutations (bearer-only, so each action re-verifies the session cookie
itself), every call here goes through api.ts's actingAgent option,
which already verifies the session and refuses to call the engine
without one — no redundant hasValidSession() gate needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ConversationScreen's assignee control now lists the Agent roster
(listAgents(), ACTIVE Agents only) instead of the old single-operator
Anyone/Me toggle: "Anyone" (null), "Assign to me" (resolves selfId from
getMe()), then every other active Agent by name. putAssigneeAction's
signature follows the api.ts body-shape change (assigneeAgentId).

Unassigned/Mine/Assigned (InboxScreen, folder-counts.ts) now split on
assigneeAgentId against the viewing Agent's own id, not the retired
'me' sentinel — every route that renders these folders (the shell
layout's rail counts, /dashboard, /inbox/[folder], /conversations/[id])
now fetches getMe() to supply that id. Next's fetch request memoization
collapses the repeated getMe() calls within one render pass to a single
network round trip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The env-var docs now describe the /setup-first-run + per-Agent-login
story (specs/auth/agents-and-auth.md §8) instead of HT-51's single
shared operator password, and the "Shipped so far" section lists the
Agents & Authentication surfaces this branch adds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Two-lens adversarial review + live browser drive of the full stack:
- invited-Agent Save dead-end (MAJOR): an admin Save always bundled
  `status`, which the engine's closed lifecycle 409s on invited Agents —
  every edit of a pending invite failed; status is now omitted for invited
- timezone select gains 'UTC': Intl.supportedValuesOf('timeZone') does not
  include it (verified live), so the engine-default 'UTC' fell back to the
  first option and a Save silently rewrote it to Africa/Abidjan
- role segmented controls: broken label htmlFor (no matching control)
  replaced with semantic <fieldset aria-label> per biome a11y
- setupAction: non-409 failures now show generic copy, never raw internals
- invite-accept: 8-char helper text (consistency with /setup)
- LoginScreen doc: the email field's TextInput limitation added to the
  HT-52 tracking note

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

General / Appearance / Keyboard shortcuts down a left rail (the same
FolderItem rail the Agent detail area uses) — Settings sections are the
injection points HT-56 and modules extend; client-side section state
within the one route until sections gain depth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

A theme is a personal preference — the three-scope rule puts it in the
personal scope, not Manage → Settings (TJ). Device-local persistence for
now; account-synced preference rides HT-61.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>