docs: permissions, console and imported IMVU products

Design for managing products, catalogs and importers: permissions as
resource:action strings bundled into roles at a scope, one console scoped
by permission, a tagged audit log, cases, notifications, API tokens and
charts (console.md); catalogs importing IMVU products with their
creators' grants (imports.md); and the contract changes (products.md).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -250,6 +250,16 @@ number, `productdata/<id>/<revision>/`) but hardly shows them; T5DE shows them o
   the link.
 - **Seeing versus wearing** (**Decided**): anyone can *see* any catalog's products on someone else (subject to their
   own age settings); getting and wearing them needs membership where the catalog requires it.
+- **Managing catalogs** (**Decided**, 2026-11-04): teams (owner and operators), members and invites, settings, key
+  rotation, delisting what they host, suspension by moderators; deleting a catalog goes to moderators' review for
+  now. Revisions can be mirrored to more catalogs. Routes in products.md, permissions in console.md.
+
+### Imported IMVU products (**Decided**, 2026-11-04)
+
+Creators who sell on IMVU can grant a catalog permission to import their IMVU products (the whole shop or chosen
+ones); the catalog's importer (`t5de-importer`) fetches them from IMVU and hosts them as ordinary T5 products, so
+responsibility stays with catalogs and nothing changes for proxies. Anyone can request a product or shop; admins can
+record a creator's consent on their behalf. See imports.md.
 
 ## In the client's shop and inventory (planned, the user's goal)
 
@@ -346,6 +356,12 @@ Profile, products across all catalogs, follows, and release notifications (over
   pushed to every proxy; ban a person; close a hosted room; mute or ban in rooms.
 - **Console** on the hub's website: report queue, live views (rooms, reports) over server-sent events, actions,
   audit log. Catalog operators get their catalog's queue there too.
+- **Permissions** (**Decided**, 2026-11-04): code checks `resource:action` permissions; roles are bundles of them
+  given at a scope (hub, catalog, product, room). Everyone who controls something gets the console, showing only
+  what their permissions cover, with a scoped audit log, cases (reports, appeals, reviews), notifications, API
+  tokens and charts. See console.md.
+- **Product info**: new uploads are drafts the creator reviews (title, description, rating, tags, category, listed)
+  and publishes; moderators can edit any product's info with a reason shown to the creator, and lock fields.
 
 ## Payments later (**Decided**: free first)
 
@@ -448,6 +464,23 @@ The proxy streams and adds no waiting.
 6. Better looks (renderer work; can run alongside 3 or later).
 7. Later: payments.
 
+## Next (2026-11-04)
+
+Phases for products, catalogs and imports (products.md, console.md, imports.md):
+
+1. Permissions and console foundations: the permission check, roles, the console for everyone who controls
+   something, a tagged audit log, membership enforced, catalog settings, team and key rotation, suspension.
+2. Product info: drafts, moderator edits with reasons and locks, info history, unlisted products, tags and category.
+3. Cases (reports, appeals, reviews), file blocks and the catalogs' changes feed; notifications; API tokens;
+   two-factor sign-in for sensitive permissions.
+4. Imports: grants, recorded grants, requests, unclaimed creators, the job queue, `t5de-importer` (after its spike).
+5. Charts and stats; mirroring between catalogs.
+
+Later: custom roles; time-limited roles; announcements and maintenance mode; audit retention; webhooks; catalog
+health alerts and storage quotas; CSV exports; scheduled publishing; revision diffs; product collections; following
+creators; favorites and wishlists; search by catalog and gender; outfit links; trying a product on in the client;
+previews drawn by t5de-renderer; import dry runs, flattened imports, and the client's "Get on T5DE" button.
+
 ## Open questions
 
 - The takedown contact and legal entity for the hub itself.