P0: Next.js shell — tokens, motion, SlidePanel, LeftRail, auth plumbing

- Tailwind v4 @theme block encoding all spec §2 tokens; full §3 keyframe
  inventory with prefers-reduced-motion handling; Geist vendored (air-gap)
- SlidePanel width-animation primitive (component-tested: exit-transition
  unmount, fixed-width inner content, a11y region semantics)
- session-key.ts mirroring the Rust codec + URL-param encoding; nuqs
  panel-params with spec ?sessions=1 flag shape and routines->scheduled alias
- Zod-typed API client; httpOnly cookie session bridge (/auth/session);
  login page; (workspace) layout with LeftRail roster/nav/user; Team and
  Credits pages on real endpoints (+ GET /api/team/members in tc-api)
- Vitest + Testing Library harness (26 tests); ESLint max-lines 1250 +
  no-warning-comments mirroring the CI gates

Co-Authored-By: Claude Fable 5 <[email protected]>

frontend/src/app/(workspace)/layout.tsx

@@ -0,0 +1,29 @@
+import { redirect } from "next/navigation";
+
+import { LeftRail } from "@/components/shell/LeftRail";
+import { ApiAuthError } from "@/lib/api/http";
+import { fetchClaws, fetchMe } from "@/lib/api/team";
+import type { Agent, User } from "@/lib/api/schemas";
+
+// Every workspace page shares the persistent rail (§4). This layout reads
+// only path-level data — search params stay client-side (see panel-params).
+export default async function WorkspaceLayout({
+  children,
+}: Readonly<{ children: React.ReactNode }>) {
+  let user: User;
+  let roster: Agent[];
+  try {
+    [user, roster] = await Promise.all([fetchMe(), fetchClaws()]);
+  } catch (error) {
+    if (error instanceof ApiAuthError) {
+      redirect("/login");
+    }
+    throw error;
+  }
+  return (
+    <div className="flex min-h-dvh">
+      <LeftRail user={user} roster={roster} />
+      <main className="min-w-0 flex-1">{children}</main>
+    </div>
+  );
+}