feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/products/[id]/page.tsx

@@ -19,7 +19,7 @@ export async function generateMetadata({ params }: { params: Promise<{ id: strin
 export default async function ProductPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   const [me, data] = await Promise.all([getMe(), loadProduct(id)]);
-  const { product, revisions, inLibrary, stayOn, mine } = data;
+  const { product, revisions, inLibrary, stayOn, mine, available, catalogs } = data;
   const using = inLibrary ? inUse(revisions, stayOn ?? product.latest) : undefined;
 
   return (
@@ -62,10 +62,24 @@ export default async function ProductPage({ params }: { params: Promise<{ id: st
                     Remove
                   </SubmitButton>
                 </>
-              ) : (
+              ) : available ? (
                 <SubmitButton name="intent" value="get" pendingLabel="Getting…">
                   Get
                 </SubmitButton>
+              ) : (
+                <span className="text-sm text-muted-foreground">
+                  Members only. Join{" "}
+                  {catalogs.map((c, i) => (
+                    <span key={c.id}>
+                      {i > 0 && (i === catalogs.length - 1 ? " or " : ", ")}
+                      <Link href={`/catalogs/${c.id}`} className="font-medium text-foreground underline-offset-4 hover:underline">
+                        {c.name}
+                      </Link>
+                      {c.joined === "requested" && " (asked)"}
+                    </span>
+                  ))}{" "}
+                  to get it.
+                </span>
               )}
             </div>
           </ActionForm>

apps/web/app/products/page.tsx

@@ -8,15 +8,24 @@ import { api, getMe, unwrap } from "@/lib/api";
 
 export const metadata: Metadata = { title: "Products" };
 
-export default async function Products({ searchParams }: { searchParams: Promise<{ q?: string | string[] }> }) {
-  const raw = (await searchParams).q;
-  const q = typeof raw === "string" ? raw.trim().slice(0, 100) : "";
-  const [me, { products }] = await Promise.all([getMe(), api.products.get({ query: q ? { q } : {} }).then(unwrap)]);
+export default async function Products({
+  searchParams,
+}: {
+  searchParams: Promise<{ q?: string | string[]; creator?: string | string[] }>;
+}) {
+  const params = await searchParams;
+  const one = (v: string | string[] | undefined, max: number) => (typeof v === "string" ? v.trim().slice(0, max) : "");
+  const q = one(params.q, 100);
+  const creator = one(params.creator, 64);
+  const [me, { products }] = await Promise.all([
+    getMe(),
+    api.products.get({ query: { ...(q ? { q } : {}), ...(creator ? { creator } : {}) } }).then(unwrap),
+  ]);
 
   return (
     <>
       <div className="flex flex-wrap items-start justify-between gap-4">
-        <PageHeader title="Products">Community products for T5DE.</PageHeader>
+        <PageHeader title="Products">{creator ? `By ${creator}.` : "Community products for T5DE."}</PageHeader>
         {me && (
           <Link href="/products/new" className={buttonVariants({ className: "px-4" })}>
             New product
@@ -25,6 +34,7 @@ export default async function Products({ searchParams }: { searchParams: Promise
       </div>
       <form action="/products" className="mb-6 flex w-full max-w-md gap-2">
         <Input type="search" name="q" defaultValue={q} placeholder="Search products" aria-label="Search" />
+        {creator && <input type="hidden" name="creator" value={creator} />}
         <Button type="submit" variant="outline">
           Search
         </Button>