flagon-io/g1t

Closes #290.

The data on one page

• Code's Overview (-/overview) now holds what -/workspace showed: the ground truth (streamed, members with Code access), the month's usage against the plan, and the members. -/workspace is gone; the Workspace app and mode open on the settings instead.

Settings open on a Profile

• -/settings opens -/settings/profile, as GitHub's organization settings open on General.
• The Profile edits the display name, the picture, the description, the URL, a public email, the location and up to 4 social accounts. Every member can read it, and only owners can change it. The workspace's own page shows the new fields under its description.
• Owners also get a private billing email there. Identity keeps it, the workspace's Stripe customer is given it (set_customer_email), and a new customer is made with it. Getting started, the address, data residency and the danger zone stay on the Profile.
• Requiring two-factor authentication moved to a new Authentication security page, with Single sign-on under it.

Settings laid out like GitHub's

• Every settings page sits under -/settings/…. The sidebar has the Profile on top, then Access, Code planning and automation, Security, Third-party access, Integrations and Archive, each under a heading between rules. A page's sub-pages show under it while you are on one: Billing → Usage and Provider costs, Members → Invitations, Repositories → Rules, AI → Guardrails, Actions → Runners, Chat → Emoji, Authentication security → Single sign-on.
• The old root addresses do not redirect; legacy redirects aren't wanted. Every internal link, email, Stripe return URL, refusal message, connector link and doc points at the new addresses.
• The token guards in website-token.ts (tokens pages, deleting the workspace, transfers, payment intents) match the new paths.
• The code gate still closes the settings of Code's parts to members without Code access: repositories, rules, actions, runners and code security.

Sidebar fit under the app bar

• The desktop sidebar was h-full while pinned between the app bar and the bottom, so it hung one app bar's height off the window. Each mode's list was also h-full under its header. The bottom rows (for example Integrations and Audit log) could not be reached. The sidebar now sizes by its top and bottom, and the list fills what is left under the header and scrolls. This applies to every mode's sidebar.

Backend

• Identity: migration 0055_workspace_profile.sql adds website, email, location, social_accounts and billing_email. update_workspace takes each field optionally and checks it: https addresses (a bare domain gets https), emails normalised, at most 4 social accounts. New workspace_billing_email for owners and billing managers. AdminWorkspaceDetail.billing_email added.
• Billing: owner_email prefers the workspace's billing email. New set_customer_email.

Checks run locally

• npm run typecheck
• npm test --workspaces
• cargo test for g1t-contracts, identity, billing, repos, packages and integrations
• prettier
• No new rustfmt drift in the changed Rust files
• The sidebar and the Profile were looked at in a scratch harness: at a 720px window the list ends at the window's bottom and scrolls.