feat(dashboard): ground enterprise-facing surfaces in HR/IAM vocab (#124)

[servathadi]

Closes #124. Do not merge — Kasra gates.

Grounds the enterprise-facing dashboard surfaces in the HR/IAM vocabulary from agents/kasra/designs/ENTERPRISE-VOCAB.md, following the three-renderings rule: operator/work surfaces keep their "substrate console" skin and are not touched.

Order of operations (preserve, then ground)

1. Preserve — docs/vocab-operator-artifact.md snapshots the operator/admin label strings as they were before grounding, so the operator rendering's wording is never lost (kept by design).
2. Ground — the enterprise surfaces below are re-labelled per the glossary + its 5 highest-leverage choices.

Surfaces classified ENTERPRISE (grounded)

Surface	Before → After
/admin/members	Members → People & Access; Roster → Directory; Invite a member → Onboard a person; Capabilities → Entitlements; Grant capability → Grant entitlement; Create invite → Send invite
/admin/divisions	Divisions → Organization; · squad → · team; "head … capability" → "owner … lead entitlement"
/members	Members → Access Tokens; member → person; Mint token → Provision token; column Mint → Provision
/admin/keys	member → person; Squad (scope) → Team (scope); Mint key → Provision key; Key minted → Key provisioned (Scopes vocabulary kept — OAuth/API context, per leverage-choice #2)
/admin/connectors	Add connector → Provision credential; Active connectors → Active credentials; scope pot/squad/agent → Organization-wide / Team / AI Agent; Connector added → Credential provisioned
grant modal + scope selectors	scope-type display squad→team, org→organization (option values unchanged — API contract preserved)
role-presets prose	"one squad"→"one team", "cross-squad"→"cross-team", "Org-wide"→"Organization-wide", "members…squads…agents"→"people…teams…AI agents" (allow/deny permission identifiers like squads:write, cross-squad kept verbatim — they are the API contract, not prose)
nav	Members → People; Divisions → Organization

Surfaces classified OPERATOR (untouched — keep the skin)

Overview swimlane, Send, Approvals, Loops, Brain, Flights, Fleet, Agents, /squads/:id, /agents/:id, Setup wizard. The shared nav keeps its operator items (Send/Loops/Brain/Flights/Fleet/Agents).

Banned words check

The mupot dashboard never contained creature/hatch/gym/badge/battle/qNFT. Remaining squad/network game-vocab in enterprise views was mapped to Team / Organization. Final HTML sweep across all 5 enterprise surfaces: no game/operator word leaks into the rendered enterprise text.

Verification

• tsc --noEmit — clean
• vitest run — 865/865 pass (49 files)
• All 5 enterprise surfaces screenshotted at 1440 + 390, read, confirmed clean + readable. mupot dashboard is single-theme (dark only) — no light/dark toggle in this app.
• No hardcoded colors introduced (text-only changes); mupot's own var(--…) tokens used.

Files

• docs/vocab-operator-artifact.md (new)
• src/dashboard/index.ts, src/dashboard/keys.ts, src/connectors/dashboard.ts, src/auth/role-presets.ts

🤖 Generated with Claude Code