feat(people): add people records, roles and census workflows

AGENTS.md

@@ -21,6 +21,11 @@ What the app is and how to run it: [`README.md`](README.md). UI rules: [`docs/de
   `AGENT_MODE`. List groups with `azure:groups:read`; add or remove existing directory users in a group with
   `azure:groups:write`; the add picker lists the directory, so it is disabled without `azure:members:read`. Nothing
   else about users or groups can be edited from the dashboard.
+- **People** (`src/features/people/`): every page reads and writes through `peopleApi(context)`, which parses the
+  backend's `people.*` responses with `people.contract.ts` and, in agent mode, uses the in-memory fake
+  (`AGENT_PERMISSIONS`, `AGENT_PERSON` pick the viewer). `/dashboard` admits `people:self` without `admin:access`;
+  Capo Admin and Team Lead come from the person's own record (`peopleRoles` in the route context) and only open their
+  sections. Handoff notes, decisions and the plan: `docs/people/`.
 - **Shared UI**: `src/components/shell`, `src/components/primitives`, `src/components/ui`.
 
 ## Conventions

README.md

@@ -7,6 +7,13 @@ group membership management. Directory access requires `azure:members:read`; cre
 `azure:members:create`, and changing member IDs `azure:members:write`. Groups require `azure:groups:read`; adding and
 removing members `azure:groups:write`.
 
+**People** keeps one record per volunteer and member (Overview, Member register, Admins, Teams, Census, Linking), plus
+Telegram › Capo Admin and Account › My area for volunteers themselves. The dashboard talks to a typed `people.*`
+contract (`src/features/people/people.contract.ts`, documented in `docs/people/contract.md`); until the backend
+implements it, agent mode serves sample data from `people.fake.server.ts`. Permissions: `people:read`, `people:write`,
+`people:members:read`, `people:members:write`, `people:appoint`, and `people:self`, which alone admits non-admins to My
+area and, by the role on their record, Capo Admin or their team. See `docs/people/README.md`.
+
 Built with TanStack Start (React 19), Vite+, Nitro, Tailwind CSS v4 and shadcn/Base UI. The server is an OIDC BFF:
 only it holds the IdP access/refresh/ID tokens. Browsers hold an opaque, HttpOnly session cookie; sessions live in a
 **dedicated Redis**, separate from the shared backend Redis. Backend requests carry a user bearer token, and permissions
@@ -24,21 +31,23 @@ Signing in as a real user needs a development client registered in the IdP.
 
 Set the following runtime variables (the build does not need secrets):
 
-| Variable                  | Meaning                                                                                                                                                                                                                                              |
-| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `APP_URL`                 | Dashboard's public origin. Required outside development; HTTPS in production. Development defaults to `http://localhost:$PORT` (3001). Used for exact Origin CSRF validation and callback/logout URLs.                                               |
-| `BACKEND_URL`             | tRPC backend origin; use the in-cluster service address in production. Defaults to `http://localhost:3000` in development.                                                                                                                           |
-| `IDP_URL`                 | Public IdP origin; defaults to `https://auth.polinetwork.org`. Issuer is `$IDP_URL/api/auth`. Browser redirects retain this public origin.                                                                                                           |
-| `IDP_INTERNAL_URL`        | Optional internal IdP origin, e.g. `http://auth-service.auth.svc.cluster.local:3000`. Rewrites discovery, token, JWKS and revocation transport only; issuer, JWT assertion audiences (public token/revoke endpoints) and browser URLs remain public. |
-| `OIDC_CLIENT_ID`          | Registered confidential dashboard client, with authorization code and refresh grants, scopes `openid profile email offline_access backend:admin`, and backend resource link.                                                                         |
-| `OIDC_CLIENT_PRIVATE_JWK` | Private signing JWK JSON with `kid` and `alg` (`EdDSA`/Ed25519 or `ES256`/P-256); inject from this service's Key Vault. Register only its public JWKS in the IdP.                                                                                    |
-| `OIDC_CLIENT_SECRET`      | Alternative `client_secret_basic` credential; set exactly one client credential mode.                                                                                                                                                                |
-| `BACKEND_RESOURCE`        | Backend OAuth resource/audience; defaults to `https://backend.internal.polinetwork.org`. Sent on every authorize, code exchange and refresh request.                                                                                                 |
-| `REDIS_URL`               | Dedicated dashboard Redis connection. Required outside development; development defaults to `redis://localhost:6379`. Never point to shared backend Redis.                                                                                           |
-| `SESSION_SECRET`          | Independent random secret of at least 32 characters, encrypting the 10-minute state/nonce/PKCE cookie. Rotation invalidates pending login attempts.                                                                                                  |
-| `AGENT_MODE`              | Fake all-permission user in development only. Backend must be a local fake or local legacy test instance. Production ignores this mode.                                                                                                              |
-| `PORT`                    | Local listening port (3001 by default); use a port ≥10000 for agent previews.                                                                                                                                                                        |
-| `TEST_REDIS_URL`          | Opt-in disposable Redis for integration tests. Tests create/delete only UUID session keys.                                                                                                                                                           |
+| Variable                  | Meaning                                                                                                                                                                                                                                                                                                       |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `APP_URL`                 | Dashboard's public origin. Required outside development; HTTPS in production. Development defaults to `http://localhost:$PORT` (3001). Used for exact Origin CSRF validation and callback/logout URLs.                                                                                                        |
+| `BACKEND_URL`             | tRPC backend origin; use the in-cluster service address in production. Defaults to `http://localhost:3000` in development.                                                                                                                                                                                    |
+| `IDP_URL`                 | Public IdP origin; defaults to `https://auth.polinetwork.org`. Issuer is `$IDP_URL/api/auth`. Browser redirects retain this public origin.                                                                                                                                                                    |
+| `IDP_INTERNAL_URL`        | Optional internal IdP origin, e.g. `http://auth-service.auth.svc.cluster.local:3000`. Rewrites discovery, token, JWKS and revocation transport only; issuer, JWT assertion audiences (public token/revoke endpoints) and browser URLs remain public.                                                          |
+| `OIDC_CLIENT_ID`          | Registered confidential dashboard client, with authorization code and refresh grants, scopes `openid profile email offline_access backend:admin`, and backend resource link.                                                                                                                                  |
+| `OIDC_CLIENT_PRIVATE_JWK` | Private signing JWK JSON with `kid` and `alg` (`EdDSA`/Ed25519 or `ES256`/P-256); inject from this service's Key Vault. Register only its public JWKS in the IdP.                                                                                                                                             |
+| `OIDC_CLIENT_SECRET`      | Alternative `client_secret_basic` credential; set exactly one client credential mode.                                                                                                                                                                                                                         |
+| `BACKEND_RESOURCE`        | Backend OAuth resource/audience; defaults to `https://backend.internal.polinetwork.org`. Sent on every authorize, code exchange and refresh request.                                                                                                                                                          |
+| `REDIS_URL`               | Dedicated dashboard Redis connection. Required outside development; development defaults to `redis://localhost:6379`. Never point to shared backend Redis.                                                                                                                                                    |
+| `SESSION_SECRET`          | Independent random secret of at least 32 characters, encrypting the 10-minute state/nonce/PKCE cookie. Rotation invalidates pending login attempts.                                                                                                                                                           |
+| `AGENT_PERMISSIONS`       | Development only. Comma-separated permissions for the agent-mode user (default: all). `people:self` alone previews the restricted People view.                                                                                                                                                                |
+| `AGENT_PERSON`            | Development only. The agent-mode user's People record (default `P-0007`, Direttivo). `P-0098` is a Capo Admin, `P-0034` the IT Team Lead, `P-0115` an IT member; `match:P-0115` previews the first sign-in, `none` a sign-in without a record. Sending an invite prints its link in the dev server's console. |
+| `AGENT_MODE`              | Fake all-permission user in development only. Backend must be a local fake or local legacy test instance. Production ignores this mode.                                                                                                                                                                       |
+| `PORT`                    | Local listening port (3001 by default); use a port ≥10000 for agent previews.                                                                                                                                                                                                                                 |
+| `TEST_REDIS_URL`          | Opt-in disposable Redis for integration tests. Tests create/delete only UUID session keys.                                                                                                                                                                                                                    |
 
 Before review run `pnpm check`, `pnpm typecheck`, `pnpm test` and `pnpm build`. Run real Redis tests with
 `TEST_REDIS_URL=redis://127.0.0.1:<test-port> pnpm test`. The OIDC integration test uses a local fake provider with

docs/design.md

@@ -115,8 +115,9 @@ the `h1`.
 **Small screens** (below 760px). Rail and panel leave the layout. A 56px top bar holds the logo (Overview), the
 service title ("PoliNetwork Admin" on Overview), Search, the theme toggle and the avatar; the service's sections follow
 as horizontally scrolling pills that scroll away with the page. The current pill stays in view after navigation,
-font loading and changes to the bar's width, including when it first appears below 760px. A 64px bottom nav lists the six services (current one
-accent with a top bar, Reports with the open-reports dot). Section pills and bottom nav are the only navigation; there
+font loading and changes to the bar's width, including when it first appears below 760px. A 64px bottom nav lists the visible services (current one
+accent with a top bar, Reports with the open-reports dot). The device's bottom safe area adds space below the 64px
+bar. Below 360px, WhatsApp uses "WA" so all labels remain readable. Section pills and bottom nav are the only navigation; there
 is no sheet.
 
 **Command palette** (`⌘K`/`Ctrl+K`, the rail and top bar Search, the Overview search): sections, "Find “…” in
@@ -350,6 +351,10 @@ shows the hover line with a text cursor, and gets the normal border and ring whe
 `aria-label` in place of the visible label. Use it only for a value edited in place inside a working surface, where a
 box around every value would be clutter; forms keep boxed fields.
 
+Calendar dates use a custom picker at every viewport, display the same day–month–year format as read-only dates,
+and retain ISO values for the server. Month and year selectors are custom controls; calendars start on Monday.
+Grant date/time fields use the calendar and time wheels on touch devices too, with no native date/time fallback.
+
 **Alerts and toasts.** `InlineAlert` for what persists or needs action: load errors, dialog submit errors, partial
 saves. It defaults to `tone="danger"` and `role="alert"`, so pass another tone for notices that aren't errors. Toasts
 (`appToast.success/info/warning/error`, never raw `toast`) confirm actions; untinted, tone on the icon only, at most
@@ -575,3 +580,23 @@ Rules that the templates above don't imply.
   request.".
 - **Account**: permissions are grouped by area (Dashboard, Telegram, WhatsApp, group labels, Microsoft 365, Web) with
   the service icon.
+- **People**: one record per person whether or not they have an account; Overview, Member register, Admins, Teams,
+  Census and Linking all open the same record (`/dashboard/people/$personId`). Account status always shows a badge,
+  Not linked included. Mobile list cards replace unlabelled column values with one line of role chips or status
+  badges in the name cell. Dialogs that need fields and are destructive (End admin role, End membership, I'm leaving)
+  use `FormDialog` with `tone="danger"`; plain confirmations stay `ConfirmDialog`.
+- **Member register**: status segments scope the table; Number leads on desktop, the name on mobile. Add member from a
+  record opens the register's dialog via `?add=P-…`. Export confirms before downloading. Register rows open full
+  records only with `people:read`; `people:members:read` alone reads the register projection. A single row action is
+  an icon button; menus never repeat a row's record link.
+- **Admins**: Groups, Capo Admin of reference, Member and Census never hide; the rest follow the table width. The four
+  quick filters scroll sideways on phones.
+- **Teams**: index cards then all members; a Team Lead without `people:read` sees only their team, as the section
+  itself. Team-field columns come from `TEAMS` in `people.contract.ts`. Leads of several teams can open each of their own
+  teams; only `people:appoint` with admin access can end a Lead role.
+- **Census**: answer segments become a filter menu on phones. The import wizard skips steps with nothing to settle and
+  saves nothing before Confirm. Reminders report sent and skipped counts after sending.
+- **Linking**: Needs review is a queue (its count sits next to the section like Reports › Open); each review kind has
+  its own resolutions and a required reason.
+- **Capo Admin** (Telegram) and **My area** (Account): self-service pages that open with `people:self` and a role on
+  the person's own record; no personal emails of others, only phone, Telegram and PoliNetwork addresses.

docs/people/README.md

@@ -0,0 +1,31 @@
+# People area: handoff
+
+Everything an agent needs to build, or continue building, the People area of the dashboard.
+
+| File                           | What it is                                                                               |
+| ------------------------------ | ---------------------------------------------------------------------------------------- |
+| [`brief.md`](brief.md)         | The original brief, verbatim                                                             |
+| [`decisions.md`](decisions.md) | What was settled after the brief: owner decisions, navigation, per-page rules, roles     |
+| [`contract.md`](contract.md)   | The `people.*` backend contract the dashboard codes against                              |
+| [`plan.md`](plan.md)           | Phases, checklist and progress log: **start here to know what is done and what is next** |
+| [`prototype/`](prototype/)     | The clickable prototype's source (structure and copy reference only)                     |
+
+## Continuing the work
+
+1. Read `AGENTS.md` and `docs/design.md`, then `decisions.md`, `contract.md` and `plan.md` in that order.
+2. Check out branch `claude/eager-mayer-bsom7v` and read the open pull request and its latest commits.
+3. Pick the first unchecked item in `plan.md`. Commit small and often; tick the box and add a progress-log line in the
+   commit that finishes an item.
+4. Run `PORT=1xxxx AGENT_MODE=true pnpm dev` to see the pages with sample data; set `AGENT_PERMISSIONS` and
+   `AGENT_PERSON` (once phase 1 adds them) to preview restricted roles.
+
+## The prototype has visual errors
+
+The prototype fixes what each page shows and does, not how it measures. Its spacing, paddings, column widths and some
+components are hand-made and wrong in places. Do not copy its CSS or markup: build from the repo's shell and primitives
+so spacing and behaviour match the rest of the dashboard, and fix anything that looks off. See "Prototype is a
+reference" in `decisions.md` for the known defects.
+
+Prototype canvas (owner only, all pages in desktop/mobile × light/dark): <https://claude.ai/artifact/7rwGssnepqJ2nWuLvGLrjT>
+
+Permission matrix: [`permissions.md`](permissions.md).