AppShell: clickable user menu with logout (fix missing logout UI)

[mastermanas805]

Summary

User report: "logout in dashboard is missing." Confirmed: api.logout() clears the token at src/api/index.ts:190, ContractsPage.tsx references the /auth/logout endpoint, but no UI surface called it. The topbar avatar at src/layout/AppShell.tsx:240 was a static <div className="avatar">A</div> — visually clickable but inert. Users were stuck unless they cleared localStorage by hand.

Replace it with a UserMenu component:

• Trigger is still the circular avatar — now shows the first letter of the user's email instead of hardcoded "A".
• Clicking toggles a dropdown anchored bottom-right of the trigger.
• Dropdown shows: email (mono, dim) → team name + tier badge → divider → Account settings (Link to /app/settings) → Log out button.
• Log out calls api.logout() then navigate('/login').
• Click-outside (mousedown) and Escape close the dropdown; listeners are attached only while open.

Coordination

P1 (PR #40) added the experiments field on /auth/me. UserMenu only reads ctx.me?.user?.email, ctx.me?.team?.name, and ctx.me?.team?.tier — experiments is untouched.

Test plan

• npm test — 290 pass / 3 skipped across 15 files (was 284 / 3 / 14). +6 new tests in UserMenu.test.tsx:
  1. Avatar shows first letter of email
  2. Click trigger opens dropdown (asserts role="menu" + email/team/tier text)
  3. Click-outside (mousedown) closes
  4. Escape key closes
  5. Log-out click → api.logout() called + /login route renders
  6. Account-settings click → /app/settings route renders
• npm run build — clean (✓ built in 685ms, 116 static pages)
• Manual smoke after deploy: click avatar in /app/*, confirm dropdown opens, click "Log out", confirm token cleared and redirect to /login
• Manual smoke: confirm dropdown closes on click-outside and Escape