feat: teams and workspaces with wallet invitations

[itexpert120]

Summary

• Add team context to the auth plugin: active team on the session, feature-area metadata on teams, and setActiveTeam / listUserTeams endpoints (migration 0003_teams_workspaces).
• Gate node, validator and tenant-node mutations in the API by the active team's node-operations area via a new requireTeamArea middleware. Org owners, org admins and platform admins bypass it, and members with no active team keep their existing access.
• Let organization owners invite an email address or a NEAR account, optionally targeting a team. Wallet invitations are accepted or rejected via acceptNearInvitation / rejectNearInvitation and are discovered independently of email verification.
• Email invitation links now point to /orgs/invites/:id. Better Auth's own accept is blocked for wallet invitations.
• Add dashboard UI: Teams tab with area grants, a unified invite form, wallet-aware invitation cards, and a sidebar team switcher. Navigation hides ungranted areas, and direct navigation to them redirects to /dashboard?restricted=<area>.
• Enable Better Auth teams in the UI auth client and add CONTEXT.md glossary entries, a walkthrough doc and a changeset.

Testing

• API unit tests (team-auth) and integration tests (team-gating): 13 files, 116 tests passed.
• UI suite: 63 files, 354 tests passed.
• Auth wallet invitation integration suite (10 tests) and utils suite (31 tests) passed.
• Playwright team-workspace.spec.ts passed against the local dev stack. It covers team creation and area grants, email and wallet invites, accepting each, restricted navigation, 403 on the node mutation probe for a Finance team, and owner/admin bypass.
• bun typecheck: all 8 targets passed. bun lint: passed with warnings.
• Not verified: external wallet SIWN signature flow. The NEAR sandbox setup timed out in this environment, so its 4 SIWN tests did not run.
• Not green: the host remote-runtime browser suite fails its navigation check because the deployed remote UI has no Skill link. It targets the deployed UI, not this change.
• Not green: a broad auth-suite run timed out in the session-revocation test. It passed when rerun with --maxWorkers=1.
• Not tested: real mailbox delivery. Email was preview-only locally.

[elliotBraem]

Also browser regession failures

  1) [dev] › tests/regression/browser/specs/team-workspace.spec.ts:84:3 › team workspace › team membership, rename and deletion refresh the mounted workspace 

    Error: expect(locator).toHaveCount(expected) failed

    Locator:  getByTestId('team-switcher')
    Expected: 0
    Received: 1
    Timeout:  5000ms

    Call log:
      - Expect "toHaveCount" getByTestId('team-switcher') with timeout 5000ms
      - waiting for getByTestId('team-switcher')
        14 × locator resolved to 1 element
           - unexpected value "1"


      137 |     await page.getByTestId(`teams-tab-delete-${team.id}`).click();
      138 |     await expect(page.getByTestId("workspace-active-team")).toHaveCount(0);
    > 139 |     await expect(page.getByTestId("team-switcher")).toHaveCount(0);
          |                                                     ^
      140 |     await expect(page.getByTestId(`teams-tab-team-${team.id}`)).toHaveCount(0);
      141 |     expectNoHydrationFailure(pageErrors);
      142 |   });
        at /home/runner/work/citynode.app/citynode.app/tests/regression/browser/specs/team-workspace.spec.ts:139:53

    Error Context: test-results/team-workspace-team-worksp-e2feb-fresh-the-mounted-workspace-dev/error-context.md

    Retry #1 ───────────────────────────────────────────────────────────────────────────────────────

    Error: expect(locator).toHaveCount(expected) failed

    Locator:  getByTestId('team-switcher')
    Expected: 0
    Received: 1
    Timeout:  5000ms

    Call log:
      - Expect "toHaveCount" getByTestId('team-switcher') with timeout 5000ms
      - waiting for getByTestId('team-switcher')
        14 × locator resolved to 1 element
           - unexpected value "1"


      137 |     await page.getByTestId(`teams-tab-delete-${team.id}`).click();
      138 |     await expect(page.getByTestId("workspace-active-team")).toHaveCount(0);
    > 139 |     await expect(page.getByTestId("team-switcher")).toHaveCount(0);
          |                                                     ^
      140 |     await expect(page.getByTestId(`teams-tab-team-${team.id}`)).toHaveCount(0);
      141 |     expectNoHydrationFailure(pageErrors);
      142 |   });
        at /home/runner/work/citynode.app/citynode.app/tests/regression/browser/specs/team-workspace.spec.ts:139:53

    Error Context: test-results/team-workspace-team-worksp-e2feb-fresh-the-mounted-workspace-dev-retry1/error-context.md

  1 failed
    [dev] › tests/reg

[elliotBraem]

I still think this can be removed in some way? Or part of it absorbed. See packages/everything-dev contract.ts

and auth.ts

[elliotBraem]

There are trace logs still in code too, should be cleaned up once all passes