D5-S16 — The administration shell #184

An operator can see who they are signed in as, move between the organizations they belong to, read what the deployment is entitled to and what its licence says, and look through the record of what has happened — in a screen a consumer can throw away and replace with their own.

Done when

• S16.1 The shell displays the current principal's kind and display name, and shows an anonymous state distinctly from an authenticated account.
• S16.2 The shell switches the active organization through the same HTTP endpoint an ordinary caller uses; a test performs the identical switch with an HTTP client and no UI, and both succeed.
• S16.3 Every endpoint the shell calls is callable without it: enumerating the shell's calls against the public API surface finds no admin-only or UI-only endpoint.
• S16.4 The shell displays the resolved entitlement, the licence tier and the grace state, reading all three through the public API.
• S16.5 The shell reads the audit record with tenant and instant-range filters and offers no update and no delete.
• S16.6 No backend package references the shell, and the backend builds and runs with the shell's assets absent.
• S16.7 The shell holds no server-side state: it renders an error when the backend is unavailable, and nothing is lost when it does.