[Bccorb]

Console support for the v0.20 Seamless Auth API.

Closes #310
Closes #295

#310: step up before every admin write

• Organization create and update (handleCreateOrganization, handleUpdateOrganization) now call ensureStepUp() first.
• Audit of every write in the console: saving your own profile on /profile (PATCH /admin/users/:userId) was also unguarded and now steps up. Every other write the API guards already stepped up (user create, update, delete, device replacement, session revoke and revoke all, system config save, OAuth provider create, update, toggle and delete, organization delete, member add, update and remove, audit export). The console has no user import or provider retirement UI. Enrollment invites and policy draft save and discard are not step-up routes on the API, so they stay on the role alone.
• apiFetch handles 403 { error: "step_up_required" } centrally (src/lib/api.ts, src/lib/stepUpRequired.ts, src/components/StepUpRequiredHandler.tsx): it runs the step-up prompt (forcing a fresh status check, since the cached one is known to be stale) and retries the request once. Concurrent refusals share one prompt. A declined prompt shows "This action needs a recent step-up verification..." instead of "You do not have permission".
• ApiError now carries the API's error code (code).

#295: staged policy UI

New Sign-in Policy page at /policy, in the sidebar:

• Published version against the draft, as a per-setting diff (object settings compared field by field), with a warning when the draft was started from an older version.
• Edit, save and discard the draft. The editor reuses the System Configuration field controls, moved to src/components/ConfigFields.tsx and src/lib/configFields.ts (no behaviour change there).
• Dry run of the saved draft, or of unsaved edits, over the last 1 to 30 days: sign-ins and accounts evaluated, accounts the draft would refuse (with reasons), accounts with no remaining method (usersLockedOut, listed first), break-glass accounts counted separately, and a cap notice.
• Publish with expectedVersion. A 409 policy_version_conflict reloads the policy and history and tells the operator.
• Version history with version, source, when and who, a diff of any version against the policy in force, and rollback.
• Publish and rollback step up first. Reads and dry run need admin:read; edit, publish and rollback controls are hidden without admin:write, matching the API.
• System Configuration: the Login Policy section says saves apply at once and are recorded as a policy version, links to Sign-in Policy, flags a staged draft, and asks for confirmation when a policy setting is saved while a draft is staged. A config save refreshes the policy queries.

Audit events

• @seamless-auth/types bumped to ^0.31.0 (0.31.0 is the latest published version).
• New Break-Glass, Account Recovery and Policy categories (filters and summary charts); session_evicted and admin_last_admin_change_refused join their neighbouring categories, so no 0.31.0 event type falls into Other.
• Event tables on Events, User Detail and Security show a readable name with the raw type beneath it. break_glass_sign_in, break_glass_enrollment, and any event with metadata.severity: "high" get a High severity badge and count as security signals.

Contract notes

• The dry run response has no cap flag. The API strips capped before answering and only records it in the policy_dry_run event. The page shows the cap notice when usersEvaluated + breakGlassAccounts reaches 10,000, and reads a capped field if a later API sends one.
• There is no usersWithNoRemainingMethod field; the console uses usersLockedOut and the per-account lockedOut.
• publishedBy and updatedBy are user ids only, so the history links to the user rather than showing an email.

Checks

$ npm run typecheck
> tsc -b

$ npm run lint
> eslint .

$ npm run format:check
Checking formatting...
All matched files use Prettier code style!

$ npm test
 Test Files  99 passed (99)
      Tests  669 passed (669)

$ npm run build
✓ built in 184ms

$ npm run check:types-current
seamless-auth-admin-dashboard dependencies: @seamless-auth/types "^0.31.0" is current (latest 0.31.0).

New Playwright specs are in e2e/tests/policy.spec.ts (including a publish refused with step_up_required and retried), and the policy routes are seeded in e2e/personas.ts. The pinned Chromium build is not installed on this machine, so e2e ran in CI only: test (Node 22), test (Node 24), test (Node latest) and e2e all pass on 0bca7ae.