Identity + operator visibility

Why this matters

Before this sprint, operators couldn't see who they were logged in as, which workspace they were operating in, or who performed which action. M55.2 makes identity visible everywhere without exposing fingerprintable data.

Workspace switcher

POST /api/workspaces/active validates membership server-side, sets a HttpOnly + SameSite=Lax cookie, and returns 200. Single-workspace operators see a read-only badge with no dropdown. Multi-workspace operators get a searchable dropdown with create-workspace and manage-members shortcuts.

• Same-shape 400 for malformed UUIDs and non-member workspace IDs — no membership enumeration.
• Membership allow-list re-fetched on every server render; a revoked member cannot reuse a stale cookie.
• router.refresh() on successful switch propagates the new active workspace to every server component on the current page.

Account identity surfaces

User ID, auth provider, account-created, and last-update timestamps surface honestly. Security section shows password status, Google Sign-In as 'not linked — ships later' (no false-positive), and active API-key count. Privacy section lists the operator-trust model explicitly: no fingerprinting, workspace-scoped identity, hashed keys, operator-controlled Claude workflows.

Recent operator activity

Last 10 admin_audit_logs entries on /settings/account with re-sanitised metadata (defence-in-depth on top of M51 write-time sanitisation). 'You' highlight on the viewer's own rows; metadata-field count only — never raw values.