feat: cluster conversation-audit org-pin + quota + connectivity/openclaw + delivery (multi-session checkpoint)

[aikey-control] user vault friendly test-error component + tests; compliance page; i18n (en/zh).

Refs:
- multi-session checkpoint (workflow): https://github.com/aikeylabs/workflow/blob/84085e1980116dc971f419ea0929f06a91897953/sessions/conversation-audit-enterprise.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Jakegogo

web/src/pages/user/vault/friendlyTestError.test.tsx

@@ -52,6 +52,18 @@ describe('friendlyTestError matching order', () => {
     expect(out.title).toBe('aikey-proxy is not running');
   });
 
+  it('I_CLUSTER_NODE_UNRESOLVED wins over httpStatus 503 (not "Local server is unavailable")', () => {
+    // 2026-06-17 cluster follow-up: write.go maps this code to 503 but
+    // the UI had no case → it fell through to the 5xx "restart web"
+    // message for cluster team keys. Pin the cluster destination.
+    const out = friendlyTestError({
+      code: 'I_CLUSTER_NODE_UNRESOLVED',
+      httpStatus: 503,
+      message: 'team key is a cluster key; node resolved but probe target could not be built',
+    });
+    expect(out.title).toBe('Cluster node not ready');
+  });
+
   it('I_CREDENTIAL_NOT_FOUND wins over httpStatus 500', () => {
     // The credential was deleted between click and probe. Server may
     // wrap this in a 500 (it currently maps to 404, but pin the UI

web/src/pages/user/vault/friendlyTestError.tsx

@@ -24,6 +24,9 @@ import type React from 'react';
  * Cases (in match order):
  *   • I_PROXY_NOT_RUNNING    — aikey-proxy isn't running (CLI's
  *                              dedicated error code from handle_test).
+ *   • I_CLUSTER_NODE_UNRESOLVED — cluster team-key probe: node resolved
+ *                              but no probe target could be built
+ *                              (transient hub/control connectivity).
  *   • I_CREDENTIAL_NOT_FOUND — alias / id resolved to nothing (rare,
  *                              implies the row was deleted between
  *                              the test click and the backend run).
@@ -76,6 +79,26 @@ export function friendlyTestError(
       ),
     };
   }
+  if (code === 'I_CLUSTER_NODE_UNRESOLVED') {
+    // 2026-06-17: the 2026-06-11 cluster work added this code to write.go
+    // (mapped to 503) but NOT here, so a cluster team-key probe whose
+    // target couldn't be built fell through to the 5xx "Local server is
+    // unavailable" branch — the same wrong-target bug I_PROXY_NOT_RUNNING
+    // had. This case keeps it pointed at the cluster, not at restarting
+    // web. Bugfix: 20260523-test-connection-proxy-down-shows-local-server-
+    // error.md (cluster follow-up).
+    return {
+      title: tr('vault.errClusterNodeUnresolvedTitle', 'Cluster node not ready'),
+      detail: tr(
+        'vault.errClusterNodeUnresolvedDetail',
+        "This team key's credential lives on the cluster's central node. The node resolved but the connectivity probe target couldn't be built — usually a transient state.",
+      ),
+      action: tr(
+        'vault.errClusterNodeUnresolvedAction',
+        'Retry. If it keeps failing, run `aikey use <alias>` to refresh the key, or check control / hub connectivity.',
+      ),
+    };
+  }
   if (code === 'I_CREDENTIAL_NOT_FOUND') {
     return {
       title: tr('vault.errCredNotFoundTitle', 'Key not found'),

web/src/shared/i18n/locales/en/common.json

@@ -569,6 +569,9 @@
     "errProxyNotRunningTitle": "aikey-proxy is not running",
     "errProxyNotRunningDetail": "The probe routes through aikey-proxy. Start the proxy and re-run the test.",
     "errProxyNotRunningActionPrefix": "Start it in a terminal: ",
+    "errClusterNodeUnresolvedTitle": "Cluster node not ready",
+    "errClusterNodeUnresolvedDetail": "This team key's credential lives on the cluster's central node. The node resolved but the connectivity probe target couldn't be built — usually a transient state.",
+    "errClusterNodeUnresolvedAction": "Retry. If it keeps failing, run `aikey use <alias>` to refresh the key, or check control / hub connectivity.",
     "errCredNotFoundTitle": "Key not found",
     "errCredNotFoundDetail": "The vault no longer contains a credential with this alias / id. It may have been deleted in another window.",
     "errCredNotFoundAction": "Refresh the list (top-right button) and try again.",

web/src/shared/i18n/locales/zh/common.json

@@ -569,6 +569,9 @@
     "errProxyNotRunningTitle": "aikey-proxy 未运行",
     "errProxyNotRunningDetail": "检测会经由 aikey-proxy。请启动代理后重新运行检测。",
     "errProxyNotRunningActionPrefix": "在终端中启动：",
+    "errClusterNodeUnresolvedTitle": "集群节点未就绪",
+    "errClusterNodeUnresolvedDetail": "该团队密钥的凭据存放在集群中心节点。节点已解析，但连通性探测目标暂时无法建立 —— 通常是临时状态。",
+    "errClusterNodeUnresolvedAction": "请重试。若持续失败，运行 `aikey use <别名>` 刷新密钥，或检查 control / hub 连通性。",
     "errCredNotFoundTitle": "未找到密钥",
     "errCredNotFoundDetail": "保管库中已不存在使用此别名 / ID 的凭据。它可能已在其他窗口中被删除。",
     "errCredNotFoundAction": "刷新列表（右上角按钮）后重试。",