Add the member visibility switch, notes and docs to the dashboard - #1668

Summary

Last step of "member visibility" (after #1664, #1665, #1666 and #1667). It adds the switch to the dashboard, the notes and empty states a restricted member sees, and the docs.

An admin can now set a workspace to Restricted under Settings → Organization → Security → Member visibility. A member who is not an admin then sees a note on Logs and Analytics, no "by user" panel, and an empty state on Connectors and MCP Servers when nothing is shared with them. They are never sent into the setup wizard.

The default stays Open. While the setting loads, when signed out and on error, the dashboard behaves as Open, so nothing changes by accident. Merge this after #1667, so the switch is the last piece to land.

Changes

• lib/use-member-visibility.ts: new hook modelled on use-edition.ts. It loads GET /api/settings/member-visibility once per session and workspace (the key holds the token and the workspace id, so a workspace switch loads again). It reports { mode: 'open', restrictedForMe: false } while loading, signed out or on error, plus a loaded flag. API client memberVisibility.get/set in lib/api.ts next to the other settings calls.
• Settings → Organization, Security card: admin-only "Member visibility" control with Open (default) and Restricted, one line on what members see in each, Save through PUT /api/admin/settings/member-visibility, and a success or error message. When Restricted is chosen and no role of the workspace has a tool list (read from GET /api/roles, _count.toolAccess on non-system roles), a warning links to Settings → Roles.
• Logs and Analytics: for a restricted member, the note "You see your own calls. Workspace admins see all calls." Analytics hides the "by user" panel. The tables render what the API returns.
• Connectors and MCP Servers: for a restricted member with no rows, "Nothing has been shared with you yet. Ask a workspace admin for a role." A VIEWER no longer sees "Add Connector", the add tile, "Import" or "New MCP Server" / "Create your first MCP Server" in any mode, because the API answers 403 to all of them (connectors already, servers since Show restricted members only the MCP servers their roles reach #1667). EDITOR and ADMIN see the same buttons as before.
• components/onboarding-redirect.tsx: no redirect to /welcome when restrictedForMe is true. For a member who is not an admin, the check waits until the setting has loaded, so a restricted member is never sent there for a moment either. Admins are evaluated as before.
• i18n: new strings in en.json, de.json (formal "Sie") and it.json.
• Docs: new docs/operations/member-visibility.md (what each mode shows per area, set-up with roles and SSO group mapping, the 30 second propagation, what stays visible, VIEWERs cannot create servers, amcp api calls, Cloud and self-hosted). Linked from docs/sso.md (role mapping section), docs/api-reference.md (Roles & Access Control) and docs/operations/README.md. New DESCRIPTIONS line in scripts/generate-llms-txt.mjs, llms.txt and llms-full.txt regenerated.
• No backend change. The generated CLI operations are up to date.

Cloud and self-hosted: identical, in every edition, off by default.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

New Playwright spec tests/e2e/member-visibility.spec.ts (9 tests, API mocked like the other smoke tests): an admin sees the control, gets the warning without a tool list, saves Restricted (one PUT with { "mode": "restricted" }); no warning when a role has a tool list; a member does not see the control; a restricted member sees the Logs note, the Analytics note without the "by user" panel, the empty states on Connectors and MCP Servers without create buttons, and is not sent to /welcome even with the setting answering 1.5 s late; an open workspace shows none of it and a new member is still sent to /welcome. I checked that removing the "wait while loading" guard makes the /welcome test fail.

Commands, in the worktree on origin/main c7667b3:

• packages/frontend: npm run test:e2e (own next dev on port 3100): 400 passed.
• packages/frontend: npx eslint <changed files>: 0 errors. 6 warnings, all on lines this PR does not touch (logs, analytics, organization pages).
• packages/frontend: npx tsc --noEmit -p tsconfig.json: pass.
• Root: node scripts/generate-llms-txt.mjs --check: pass. node --test scripts/generate-llms-txt.test.mjs: 15 passed.
• Root: node scripts/generate-cli-operations.mjs --check: up to date (213 operations).

Not tested against a real backend: the frontend reads the response shape of #1664 and the list behaviour of #1666 and #1667.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test) (frontend has no npm test; Playwright suite above)
• This PR has a descriptive title

Related Issues

Relates to #1664, #1665, #1666, #1667.