fix: expose operator navigation and protected portal logout

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

workplans/USER-WP-0025-operator-navigation-and-logout.md

@@ -0,0 +1,85 @@
+---
+id: USER-WP-0025
+type: workplan
+title: "Make operator navigation and portal logout usable during demo onboarding"
+domain: communication
+repo: user-engine
+status: active
+owner: the-custodian
+topic_slug: user-engine
+created: "2026-09-11"
+updated: "2026-09-12"
+related: [RAPPS-WP-0014, USER-WP-0020, KEY-WP-0025]
+state_hub_workstream_id: "85391398-f5be-551b-b90d-c8e987a00098"
+---
+
+During demo-company onboarding the operator signs in as platform-root, sees
+“No tenant memberships yet”, cannot find the existing tenant, and requests a
+logout control. Source confirms that personal memberships are distinct from the
+platform-operator role. Read-only live consumer verification confirms the tenant
+active with two memberships (one administrator and one ordinary user), neither
+linked to a directory identity yet. Do not add a customer membership to the
+platform operator to work around missing navigation.
+
+## Expose authorized navigation and a protected portal logout
+
+```task
+id: USER-WP-0025-T01
+status: done
+priority: high
+state_hub_task_id: "2f40807f-5442-5bca-8c38-c2d084f8e1ef"
+```
+
+Render shared navigation on authenticated pages, with platform administration
+only for verified platform operators, tenant user management for tenant admins,
+and an accessible POST logout form using the current browser session's CSRF
+value. Keep navigation request-scoped and clear it even after failures. Explain
+personal memberships to operators and add a Manage users route from the existing
+platform tenant lookup/lifecycle page. Keep authority checks unchanged.
+
+GET /logout only displays confirmation. POST verifies CSRF for an active session,
+invalidates that session server-side, expires its cookie, and leads to a logged-out
+page explaining the remaining shared sign-in session. Expired sessions may clear
+their stale cookie without affecting another session. This is portal logout;
+provider-wide sign-out/account switching remains the explicit next task below.
+
+Validation: make test passes (175 tests, three optional integration skips) and
+layer conformance passes. Six regressions cover operator access without membership,
+ordinary-user denial, navigation isolation, logout CSRF, session invalidation and
+expired-session cleanup. Eight local Chromium checks pass for operator guidance, navigation to tenant
+users, mobile navigation, visible logout, session cookie removal and denied
+access after logout. Immutable image promotion and native verification are T02.
+
+## Publish and verify the visible change on the native portal
+
+```task
+id: USER-WP-0025-T02
+status: progress
+priority: high
+state_hub_task_id: "67e2feca-ffcd-55a0-b0ce-2bab43c862e4"
+```
+
+Check the browser flow on a local synthetic fixture, publish the exact source
+through existing Forgejo image CI, pin the resulting digest in rapp-user-engine,
+and promote only the current User Engine Deployment's image. Preserve requests,
+service identity, database, policies and secrets. Verify health/readiness and
+native operator navigation/logout when the operator is available. Deployment
+restarts invalidate the portal's in-memory sessions, so provide the sign-in URL.
+Actual demo-user Create login and password setup remain RAPPS-WP-0014-T02.
+
+## Coordinate provider-wide sign-out and account switching
+
+```task
+id: USER-WP-0025-T03
+status: todo
+priority: medium
+state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"
+```
+
+Coordinate the relying-party, KeyCape and Authelia session boundaries so one
+explicit user action can end all relevant browser sessions and allow another
+account to authenticate. KeyCape currently documents local-only logout in
+KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation
+from User Engine's cookie deletion. Use registered return locations and verify
+same-account login cannot silently reappear after complete sign-out. Preserve
+session-only logout for users who intend to keep their other applications open.