Complete flex-auth PEP and document railiance packaging path

Local + HTTP POST /v1/check PEP with fail-closed transport errors;
shell:view enforced on /app/. Vocabulary docs for T07. Helm chart lives
in railiance-apps; Dockerfile already present for T08.

coulomb_social/apps/core/views.py

@@ -1,7 +1,9 @@
 from django.contrib.auth.decorators import login_required
-from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.http import HttpRequest, HttpResponse, HttpResponseForbidden, JsonResponse
 from django.shortcuts import render
 
+from coulomb_social.apps.identity import flex_auth
+
 
 def landing(request: HttpRequest) -> HttpResponse:
     if request.user.is_authenticated:
@@ -14,6 +16,24 @@ def landing(request: HttpRequest) -> HttpResponse:
 @login_required
 def app_home(request: HttpRequest) -> HttpResponse:
     member = getattr(request.user, "member", None)
+    subject = member.subject if member else request.user.get_username()
+    tenant = member.tenant_id if member else ""
+    decision = flex_auth.check(
+        "shell:view",
+        resource="shell",
+        resource_id="app_home",
+        subject=subject,
+        tenant=tenant,
+        attributes={
+            "issuer": member.issuer if member else "",
+            "user_engine_user_id": str(member.user_engine_user_id) if member else "",
+        },
+    )
+    if not decision.allow:
+        return HttpResponseForbidden(
+            f"Not authorized to view shell ({decision.reason})."
+        )
+
     return render(
         request,
         "core/app_home.html",
@@ -33,6 +53,8 @@ def app_home(request: HttpRequest) -> HttpResponse:
                 ),
                 "tenant_id": member.tenant_id if member else "",
                 "user_engine_source": request.session.get("user_engine_source", ""),
+                "authz_decision_id": decision.decision_id,
+                "authz_reason": decision.reason,
             },
         },
     )