v0.5.3 — Product archive & hardened authorization

Products can now be archived instead of hard-deleted — the last and most guarded step in the deletion & audit initiative that started in v0.5.1. Every core entity in CodePlans (Task, WorkItem, CodePlan, Release, Asset, Product) now has consistent, authorized, audited deletion: hard-delete where safe, reversible archive where the blast radius is too large to risk getting wrong.

What's new

• Product archive/soft-delete: replaces Product's hard delete — previously cascading to every asset, plan, release, work item, and spec beneath it — with a reversible archivedAt/archivedById/archivedByKind tombstone, the same pattern proven for Assets in v0.5.2. Archiving touches nothing beneath the product; everything simply stops resolving through the shared access check until restored.
• Hardened authorization: canDeleteProduct — org owner/admin, or the product's creator — now actually gates the archive/restore path. An archived product also stops accepting new writes via MCP.
• New MCP tools: archive_product / restore_product, each disclosing the full blast radius (asset, plan, release, work item, and spec counts) in the response.
• UI: the products list's card menu swaps "Delete" for an "Archive" confirmation that shows the real counts and requires typing the product's name before the button enables — the largest blast radius in the schema gets the most explicit confirmation. Archived products move into a collapsible "Archived products" section with a Restore action; the product detail page shows an archived banner with its own Restore button.
• Closed an access-control gap: updateAssetAction authenticated the caller but never checked the asset was actually accessible to them — now uses the same accessible-asset guard already used elsewhere in the codebase.

Upgrading

One additive, schema-only migration (0022) adding three nullable columns to products. No backfill needed — existing products are simply unarchived.

pnpm install --frozen-lockfile
pnpm db:migrate

Validation

297 tests passing (10 new this release), pnpm exec tsc --noEmit clean of anything this release touched, pnpm build, and the new migration verified against a real, previously-populated local dev DB — including a live end-to-end pass against real seeded org data (owner/admin/editor authorization checked against real membership rows, archive/restore exercised through the actual mutation path with page renders confirmed against a running dev server).

Implemented in #74, version-tagged in #75.

Full changelog: v0.5.2...v0.5.3