v0.86.1: admin papercuts, drawer APG dialog, migrations shipping

Two admin passes since 0.86.0: the admin reorganization (flat zero-config sidebar, zen recede) and the admin papercuts + DX pass. A patch — no new public API surface, and no Consumers must: lines, so it is a drop-in bump.

Added

• The D1 migrations (0000_auth.sql and the roles migration 0001_roles.sql) now ship inside the npm package under migrations/, so a site installed from the registry can apply them without a repo checkout: copy them from node_modules/@glw907/cairn-cms/migrations/ into your own migrations/ directory, then wrangler d1 migrations apply. A packaging gate (check:package) now fails if the migrations ever drop out of the published file set.
• cairn-doctor gains an auth.role-wiring check. A site that declares a custom role vocabulary on its adapter but forgets to pass the same vocabulary to createAuthGuard({ roles }) gets a guard on the implicit owner/editor fallback, which resolves every custom role to the none capability. The existing auth.role-vocabulary check cannot see this; the new check reads the createAuthGuard call in src/hooks.server.ts and fails only on a high-confidence miss.

Fixed

• Admin papercuts from the 2026-07-15 UX audit, all internal to the admin chrome a consumer never imports: the edit-route desk band and the editor footer compose at phone widths instead of colliding or truncating; office lists cap at a readable width at 2560 and recompose at 320; the command palette gains a phone top inset and the admin focus ring; the guarded Publish and Figure controls read as deliberately disabled; the dark-mode Published badge clears its contrast floor; the nav drawer gains the full APG modal-dialog treatment (focus trap, inert background, independent Escape, focus return on every open method); and a copy sweep brings the admin's editor-facing strings to the calibrated voice.

Changed (from the admin reorganization pass)

• The zero-config sidebar default renders every item, cairn's own screens and a site's flat adminNav entries alike, as a loose top-level entry with no synthesized Core section. See Organize your admin nav for the grouping guidance.
• A navFilter that matched the literal Core section label now sees those items as loose nodes instead, since no Core section exists to match; no known consumer does this.
• Zen now recedes the persistent sidebar too, at every width, alongside the topbar it already dropped.