Shelf 2.1.0

Access control for restricted documentation, a much richer analytics dashboard, and a unified app shell. Backwards-compatible: existing products stay public and nothing changes until you mark a product restricted.

Added

• Restricted products & access control — mark a product restricted: hidden from anyone without a read grant, 404 on unauthorized access (no existence leak), anonymous visitors sent to login. Orthogonal to visibility.
• Permission groups — grant read access (and optionally adminship) via explicit email members or a sandboxed JsEval auto-membership predicate over the login claims snapshot. Managed under Administration → Groups, with a script dry-run.
• Product-side access grants — assign who may read a restricted product on the product's Access tab: both groups and individual users (users keyed by email, stageable before first login).
• Detailed analytics dashboard — interactive world map of visitor cities, country/city breakdowns with flags + full names, browser/OS/language/referrer breakdowns, per-product + IP-exclude filters. All aggregation server-side.
• Groups & principals API — /_api/groups/*, /_api/groups/recalculate, /_api/groups/test-script, /_api/principals.

Changed

• Unified app shell — landing and admin share one shell: same header everywhere (dark/light toggle), admin sidebar for logged-in admins on every page, dark mode on the landing.
• Analytics summary returns cities, geolocated map points and UA/language/referrer breakdowns; access log stores visitor lat/lng and shows country flags. Groups live under Administration.

Security

• Product writes via the admin cookie now require admin (previously any authenticated user could write). The CI/CD Bearer API-key path is unchanged.
• Admin can additionally be granted via an IsAdminGroup permission group.

Full details in CHANGELOG.md.