v0.35.0 — a console that explains itself

The console assumed you already knew what an IdP does. This release stops it assuming
that — and fixes the CI that had been red on main for a reason no developer machine
could reproduce.

Onboarding and help

• A "?" on every page title opens two or three sentences in plain language, and
  links to a full guide where one exists. Twelve new admin guides ship under
  docs/guides/. Nothing links to a page that does not exist: a topic with no guide,
  or a deployment with DOCS_BASE_URL blanked, renders no link at all.
• The setup checklist is measured, not asserted. Every step is derived from live
  state, so it ticks itself whether the work was done from the checklist, the page, or
  the API. The old card hardcoded "Organization created ✓" and had three items that
  could never tick. Steps an organization is not entitled to are dropped rather than
  shown locked, so the list can actually reach 100%.
• A guided first run at /get-started, with the same measured steps given room to
  explain themselves. Reachable from Settings after it is dismissed.
• Empty states teach instead of shrugging: what the thing is, why you want it, and
  the first three steps.

Navigation that means what it says

• Nav label == page heading == browser title. Six pages disagreed with the sidebar
  entry that reached them ("Stored tokens" → a page headed "Token vault"). The SCIM pair
  became Sync users in / Sync users out, which says which way people move.
• One rail area per subject. The console had grown twelve top-level areas because
  each module minted its own; analytics, compliance and risk now join the area that
  already owns their subject. Area orders are unique, so the rail no longer reshuffles
  depending on which modules are enabled.
• The activity log names people. Actor and target were raw ULIDs, so the row saying
  a member was added did not say who.

Breaking

• One env prefix, not two. The ID_* fallback kept alongside CBOX_ID_* in 0.34.0
  is removed — 37 config reads carried both spellings. See Upgrading below.

Fixed

• CI, red on main and unreproducible anywhere else: the suite needed a Redis nobody
  starts. cboxdk/laravel-queue-metrics ships enabled with a Redis storage driver and
  a listener that writes on every job dispatch. Developer machines usually have a Redis
  running, and CI does not — so the suite looked green everywhere except the one place
  that mattered. Metrics are now off for the suite, which is verified with no Redis
  reachable at all. The test environment was also made authoritative while proving it:
  tests/bootstrap.php beats anything the host exports, because phpunit.xml's <env>
  does not write $_SERVER and Laravel reads that first.
• The parallel suite. 48 tests failed under --parallel while passing serially:
  helpers declared in one test file and called from another are simply absent in the
  worker that needs them. Shared fixtures moved to tests/Pest.php, with a tokenising
  guard so the next leak fails the build.
• The accessibility guard grew from 8 console pages to 18 — all WCAG 2.1 A/AA clean.

Upgrading

Breaking: CBOX_ID_ is now the only env prefix. 0.34.0 renamed the vendored
modules' variables and kept the old ID_* names as a fallback; that fallback is gone.
An ID_* variable is now ignored rather than refused, so the setting silently falls
back to its default — CBOX_ID_DEVICES_ENABLED to off, CBOX_ID_COMPLIANCE_SINK
to null. Grep your deployment before upgrading:

grep -rn 'ID_[A-Z]' k8s/ .env | grep -v CBOX_ID_

UPGRADING.md lists the four
affected families.

php artisan migrate — one new table (onboarding_dismissals), holding the only thing
the checklist cannot derive: an admin having put it away.

Optional: point DOCS_BASE_URL at a rendered docs site (and clear DOCS_LINK_SUFFIX)
once one exists, or blank it on an air-gapped deployment to drop every outbound link.