[codex] standardize identity and enterprise console

[SeanCode-super]

Summary

• add tenant-scoped organization migration control tables and the complete UUIDv7 User/Session and User-Person binding lifecycle
• add explicit session Assignment selection, organization-context validation, tenant isolation, and fail-closed invalidation
• standardize the console as a compact enterprise workspace with functional navigation, command actions, responsive layouts, and dense data tables
• simplify the dashboard to operational metrics, named function entries, and current tenant/session context without explanatory feature copy
• resolve the default portal context and rename the default platform administrator login to admin through Flyway V32
• standardize menu resources as directories, pages, page actions, and external links through Flyway V33-V34
• replace raw permission-code and JSON editing with role authorization, resource structure, and exception authorization workspaces
• add atomic subject-grant replacement for role, user, department, position, company, and tenant subjects
• enforce resource hierarchy, action ownership, enabled-state, cycle prevention, and tenant isolation in the service layer

Why

The project is intended to be a reusable, industry-neutral SaaS foundation. Identity, natural-person subjects, organization participation, assignments, tenant context, navigation resources, and permissions therefore need explicit standard contracts. The console also needs to behave like an operational enterprise product instead of presenting the foundation as a collection of descriptive showcase cards or exposing storage formats to administrators.

Compatibility

V27-V29 use an expand/backfill sequence. User and Session public identifiers remain nullable during the rolling-upgrade and binary-rollback window, while compatibility triggers supply UUIDv7 values for older writers. A later contract migration will add NOT NULL only after rollback-eligible writers have been retired and null-count verification remains zero.

Flyway V32 changes only the default platform administrator username from platform.admin to admin; the tenant code remains platform and the development password remains unchanged.

Flyway V33 registers existing page actions as first-class BUTTON resources. Flyway V34 normalizes navigation containers to DIRECTORY and removes invalid direct directory grants.

Validation

• backend module tests passed, including 6 menu resource policy tests; Docker-backed integration tests were skipped locally because Docker is unavailable
• npm run check: production build, TypeScript, ESLint, Stylelint, and 6 Vitest tests passed; existing ESLint warnings remain non-blocking
• Flyway validated all 34 migrations against the local MySQL database
• desktop and 390px responsive browser checks passed with no document-level horizontal overflow
• role authorization, resource structure, exception authorization, parent-type restrictions, and action selection were verified in the running UI
• browser console had no application errors after the final backend restart
• git diff --check: passed

GitHub Actions must complete the MySQL Flyway, tenant-isolation, organization, and binding checks before merge.