Add app home Spaces shell and session diagnostics profile menu

Post-login lands on Spaces empty state instead of a principal dump.
Profile menu exposes Session details with identity, tenant, roles/groups,
and authz diagnostics for operator refinement (CSOC-WP-0004 T01/T07).

tests/test_shell.py

@@ -38,7 +38,7 @@ def test_app_home_requires_login(client):
 
 
 @pytest.mark.django_db
-def test_dev_login_establishes_member_and_shell(client, settings):
+def test_dev_login_lands_on_app_home_not_principal_dump(client, settings):
     settings.DEBUG = True
     settings.OIDC_ENABLED = False
 
@@ -63,8 +63,45 @@ def test_dev_login_establishes_member_and_shell(client, settings):
 
     home = client.get(reverse("core:app_home"))
     assert home.status_code == 200
+    assert b"Spaces" in home.content
+    assert b"No spaces yet" in home.content
+    # Principal dump moved off the home body
+    assert b"user-engine id" not in home.content
+    assert b"sub-abc" not in home.content
+    # Profile chrome shows display name
     assert b"Ada Lovelace" in home.content
-    assert b"sub-abc" in home.content
+    assert b"Session details" in home.content
+
+
+@pytest.mark.django_db
+def test_account_session_shows_principal_diagnostics(client, settings):
+    settings.DEBUG = True
+    settings.OIDC_ENABLED = False
+    client.post(
+        reverse("identity:dev_login"),
+        {
+            "subject": "sub-diag",
+            "issuer": "https://local.dev/issuer",
+            "name": "Diag User",
+            "email": "diag@example.com",
+        },
+    )
+    r = client.get(reverse("core:account_session"))
+    assert r.status_code == 200
+    assert b"Session details" in r.content
+    assert b"sub-diag" in r.content
+    assert b"Diag User" in r.content
+    assert b"user-engine id" in r.content
+    assert b"Tenant" in r.content
+    assert b"Roles" in r.content
+    assert b"Groups" in r.content
+
+
+@pytest.mark.django_db
+def test_account_session_requires_login(client):
+    r = client.get(reverse("core:account_session"))
+    assert r.status_code == 302
+    assert reverse("identity:login") in r["Location"]
 
 
 @pytest.mark.django_db
@@ -75,7 +112,6 @@ def test_establish_session_idempotent(client, settings):
         email="x@example.com",
         name="Once",
     )
-    # Use request factory via client session by posting twice
     settings.DEBUG = True
     settings.OIDC_ENABLED = False
     client.post(