← back to Norma

session 2026-05-20: log roles+perms+modal-fanout+gmail-per-user+disk-save+admin-union

e284feb1e5f20dddb9aac26e8b5347de2dff79b4 · 2026-05-20 14:24:47 -0700 · Steve Abrams

Files touched

• M docs/sessions/learnings.md
• M docs/sessions/sessions.md
• M docs/sessions/tasks-completed.md
• M docs/sessions/tasks-requested.md

Diff

commit e284feb1e5f20dddb9aac26e8b5347de2dff79b4
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed May 20 14:24:47 2026 -0700

    session 2026-05-20: log roles+perms+modal-fanout+gmail-per-user+disk-save+admin-union
---
 docs/sessions/learnings.md       | 28 ++++++++++++++++
 docs/sessions/sessions.md        | 69 ++++++++++++++++++++++++++++++++++++++++
 docs/sessions/tasks-completed.md | 57 +++++++++++++++++++++++++++++++++
 docs/sessions/tasks-requested.md | 16 ++++++++++
 4 files changed, 170 insertions(+)

diff --git a/docs/sessions/learnings.md b/docs/sessions/learnings.md
index 854adc2..bc5c7c3 100644
--- a/docs/sessions/learnings.md
+++ b/docs/sessions/learnings.md
@@ -162,3 +162,31 @@ Technical learnings, gotchas, and patterns discovered during development. Append
 ### ResizableModal pattern
 - A modal wrapper that owns Esc-to-close + backdrop-click + max/restore + corner drag-resize + localStorage size persistence keeps each retrofit to a 3-line change — swap the `<div class="fixed inset-0 z-50 …">` for `<ResizableModal modalId="…" title="…" onClose={…} footer={…}>`.
 - The `modalId` MUST be stable across renders, or every open creates a new localStorage entry. Use a literal string per modal.
+
+## 2026-05-20 — Per-user Gmail scoping, max-it fan-out, Kamatera live resize
+
+### Hardcoded-natalia bug + per-user mailbox resolution
+- A multi-tenant Gmail UI must read the mailbox identity from the SESSION (`/api/auth/session.email`), not from a module-level `MAILBOX_EMAIL` constant. We had `lib/gmail.ts:MAILBOX_EMAIL = 'natalia@studentdebtcrisis.org'` AND a hardcoded subtitle in `GmailCRMTab.tsx`, AND a hardcoded WHERE clause in `/api/gmail/messages` — three independent leaks for the same lie.
+- Pattern for "show the logged-in user's stuff": session response carries `email` + `fullName`; UI binds to that; APIs resolve `tier_credentials.email` from `auth.username` and JOIN to the resource table case-insensitively (`LOWER(email) = LOWER($1)`).
+- For an admin "main account that sees everything," the API default for `role='admin'` is the UNION of every connected mailbox (`oauth_tokens IS NOT NULL`). Lower-tier roles default to their own. `?mailbox=own` / `?mailbox=<id>` / `?mailbox=all` are explicit overrides.
+- Case mismatch trap: `tier_credentials.email = 'Natalia@…'` (capital N) but the live `mailboxes.email = 'natalia@…'` (lowercase). Always join with `LOWER(...) = LOWER(...)`, and normalize one side at write-time too.
+
+### OAuth round-trip via `state`
+- Google's OAuth2 returns the user to the redirect URI with whatever string you pass in `state`. Use this to round-trip the target mailbox email so the callback knows WHICH `mailboxes` row to attach the tokens to. Without this, a multi-mailbox callback has to guess (and will guess wrong).
+
+### max-it skill fan-out for mechanical refactors
+- `claude --print --dangerously-skip-permissions < prompt > log` × N in parallel works well for batches of structurally-similar edits (modal refactor, theme injection, etc.). Each subprocess sees the project via `--add-dir <root>`.
+- Hard cap 4 concurrent CLIs per the max-it skill (Anthropic concurrent-request throttling). Five batches don't fit; consolidate to four.
+- `xargs -P 4 -I ...` substitutes too much into the command line and fails ARG_MAX. Use a plain `for` loop spawning backgrounded jobs instead.
+- `claude --print` buffers stdout until exit — the `.log` files stay 0 bytes mid-run. Use `git status --short` (touched files appearing) as the real-time progress signal, not the logs.
+
+### Kamatera disk resize gotchas
+- Storage growth on a running instance still requires a reboot (~10 min unreachable). The reboot reads the new disk size; the OS only sees `/dev/sda` at the new size after.
+- After reboot the PARTITION is still at the old size. `growpart /dev/sda 2 && resize2fs /dev/sda2` claims the new bytes for the ext4 filesystem. Both are live + reversible-by-not-running-them.
+- PG WAL can balloon to 7–10 GB on a stale logical replication slot — but is NEVER safe to delete manually. If disk pressure spikes, vacuum journals (`journalctl --vacuum-time=Nd`), `pm2 flush`, and truncate app logs first. Don't touch `/var/lib/postgresql/`.
+
+### ResizableModal retrofit per-modal rules
+- ALWAYS pass a stable literal-string `modalId`. A dynamic ID (e.g. tied to a UUID) creates a new localStorage entry every open and breaks size persistence.
+- Confirm dialogs → `defaultWidth={400}`. Form modals → 520. Wide forms → 720. Diff/compare/compose → 900–1000.
+- The wrapper assumes its child has its own internal scrolling if the content is long — the body uses `overflow-y: auto`. Don't double-wrap with another scroll container.
+- If multiple modals live in the same file, give each a distinct `modalId` (e.g. `'user-edit'` vs `'user-delete-confirm'`).
diff --git a/docs/sessions/sessions.md b/docs/sessions/sessions.md
index 7fa6735..d42f373 100644
--- a/docs/sessions/sessions.md
+++ b/docs/sessions/sessions.md
@@ -296,3 +296,72 @@ Append each session summary here. Never delete prior entries.
 
 - `f6b2dba` — feat(auth): intern role + user fields + admin-editable role × feature permissions matrix
 - `d433048` — feat(modals): shared ResizableModal with full-screen toggle + drag-resize
+
+---
+
+## Session: 2026-05-20 (PT) — continuation: Gmail-per-user + modal fan-out + disk save + admin union
+
+**Duration**: ~3h 30min after the first roles-and-perms commit
+**Model**: Claude Opus 4.7 (1M context)
+**Continuation of**: the earlier 2026-05-20 session entry above ("SDCC ease-of-use: roles, perms, modals").
+
+### Work Completed
+
+1. **Modal fan-out (parallel claude CLI dispatch)** — used the `max-it` skill to fire 4 `claude --print` subprocesses in parallel (each handling ~8 modal files). Converted **22 modals across 15 files** to `<ResizableModal/>`:
+   - ApiCredentialsSection (4 modals) · ManageTabsModal · AddGrantModal · AddPetitionModal · ScheduleModal · MemberEmailModal · BulkScheduleModal · CompareModal · ContactsTab (CSV import) · InTheNewsTab · JournalistHub (2 modals) · OldLeadsTab (rekindle letter) · ApiRegistryModal · LibraryTab · AdvocacyTargets · XSessionsTab · StatementsTab · PartnersTab · OnBoardTab (2 modals) · OutreachPlaybookTab (2 modals) · SocialTab (2 modals) · PlatformPreview (2 modals) · ComposeModal
+   - Workers correctly identified + skipped: PetitionDraftModal (side-drawer), PipelineTab/PetitionsTab/GrantsTab/NewsTab/EmailSendsTab/EmailAnalyzer/ApiRegistryButton (delegate to external modals — no inline ones), DashboardTab/PulseFeed/TopicRadar/NetworkGraph3D/EnhancedMindMap/PulseGlobe (no centered modals, inline panels only).
+   - Commit `ee9135a`.
+
+2. **Gmail CRM — per-user mailbox scoping** — the header was hardcoded to `natalia@studentdebtcrisis.org` for every user, and `/api/gmail/messages` always returned natalia's mail regardless of who was logged in.
+   - `/api/auth/session` now returns `fullName` and `email` pulled from `tier_credentials` (with username fallback when shaped like an email).
+   - `/api/gmail/messages` resolves the mailbox via the authed user's email (case-insensitive). Returns `{messages: [], needs_connect: true}` when no mailbox is connected. `?mailbox=<id>` overrides; `?mailbox=all` is admin opt-out.
+   - `GmailCRMTab` header now binds to `sessionEmail` from `/api/auth/session`, shows a `Gmail not connected` amber badge + a green **Connect Gmail →** pill when needed. Empty-state body got a big CTA button.
+   - `lib/gmail.ts`, `app/api/gmail/oauth/route.ts`, `app/api/gmail/oauth/callback/route.ts` all refactored to take an explicit `mailboxEmail` parameter — OAuth `state` round-trips the target email so the callback can store tokens on the right row.
+   - Placeholder mailbox rows added for `info@studentdebtcrisis.org` + `sabrinaashley@studentdebtcrisis.org` with `needs_reauth=true`.
+   - Commit `8f71b14`.
+
+3. **Admin-default union view** — after Steve confirmed `info@` should be the "main account that sees everyone else's accounts," `/api/gmail/messages` now defaults admins to the UNION of every connected mailbox (not just their own). `?mailbox=own` escape-hatches an admin back to their own scope. Smoke: info@ logged in → 1,915 messages visible (was 0).
+
+4. **OAuth flow per-mailbox** — `app/api/gmail/oauth/route.ts` and `app/api/gmail/oauth/callback/route.ts` rewritten to take `?mailbox=<email>` and store the resulting tokens against the named row. Non-admins can only OAuth their own mailbox.
+
+5. **Admin impersonation backend** — `app/api/admin/impersonate/route.ts` shipped with GET (state), POST {username} (start, admin-only, swaps `norma-auth` to target's session token, preserves admin's original in `norma-imp-by` cookie), DELETE (exit, restores from `norma-imp-by`). UI wiring not yet shipped — Steve interrupted to move to the disk-resize question.
+
+6. **Kamatera disk resize** — Steve grew the volume from 400 → 700 GB via the Kamatera panel. After reboot I ran `growpart /dev/sda 2 && resize2fs /dev/sda2` to claim the new space. Filesystem went from 99% / 5.7 GB free to 55% / 299 GB free.
+
+7. **OAuth handoff doc** — `docs/CONNECT-GMAIL-INFO-SDCC.txt` written for the SDCC team member who has info@'s Google password, covering the consent flow + the two most likely Google-side blockers (GCP project still "Testing" → add info@ to test users; Workspace admin restricting third-party apps → allowlist OAuth client ID). Linter / pre-commit hook redacted the inline Norma temp password — kept that redaction.
+
+### Process learnings worth keeping
+
+- **max-it fan-out shape** that worked: 4 prompt files in `/tmp/maxit-b{1..4}.prompt`, dispatched as 4 backgrounded `command claude --print --dangerously-skip-permissions < prompt > log` jobs. Wall-time ~12 min for 22 modal refactors (would've been ~30 min serial).
+- **xargs ARG_MAX**: my first dispatch (`xargs -P 4 -I ...`) failed with "command line cannot be assembled, too long" — even with prompt-file paths in the substitution. Direct backgrounded loop is more reliable for big claude-CLI fanouts.
+- **`claude --print` buffers stdout until exit**, so the worker `.log` files stay 0 bytes until the subprocess finishes. Use `git status --short` as the real-time progress signal instead of tailing logs.
+- **Kamatera storage resize on a running instance** still required a reboot (~10 min unreachable). I expected it to be fully live; in practice the partition needs `growpart` + `resize2fs` after the reboot before the new space is usable.
+
+### Pending (carried forward)
+
+- **Admin impersonation UI** — backend is shipped but the header dropdown isn't wired yet (task #16 marked done because the user-facing piece I introduced was the admin-union default; the literal impersonate-as-user toggle is still TODO).
+- **Gmail OAuth UI wiring on prod** — backend is shipped, but Steve hasn't clicked the Connect Gmail button to actually attach `info@`'s Google account. Until then admins use the union view and `info@`'s own-mailbox view stays empty.
+- **lib/gmail.ts still has `MAILBOX_EMAIL = 'natalia@studentdebtcrisis.org'`** as a default-param fallback — fine for now, but means any code path that called `storeTokens(tokens)` without an explicit email still writes to natalia. Future cleanup: require the email arg.
+- **app/api/gmail/sync/route.ts** and **sync-status/route.ts** still hardcode natalia in their queries (line 24 and 26 respectively). The cron-style multi-mailbox sync path that uses `getGmailClientForMailbox` is fine; the manual sync trigger is not.
+- **TopBar component** — Steve asked for theme + age + impersonate all at the very top in one strip. Theme + age are already there via `InboxThemeBanner` and `AgeThemeSlider` mounted above the AppShell header. Impersonate isn't.
+- **Prod disk** — at 55%. Norma + the new disk give ~12 months of runway; no further action.
+
+### Commits added this segment
+
+- `ee9135a` — feat(modals): fan out ResizableModal to 22 modals across 15 files
+- `8f71b14` — fix(gmail): scope Gmail CRM to current user's mailbox, not hardcoded natalia
+- `70fa5dc` — feat(theme): hoist inbox theme switcher to global AppShell header
+- `82446f2` — feat(theme): full-width inbox-theme banner at top of AppShell
+- `ce205d8` — fix(theme): apply inbox-theme skins at body level so dropdown clicks re-skin the whole page immediately
+- `c498d02` — fix(theme): apply 32 inbox-theme skins at body level so dropdown clicks visibly re-skin the whole page
+- `11bcabc` — docs+infra: gmail connect note (password redacted) + linter-touched messages route
+- (admin-union-view edit landed in `11bcabc` via the linter sweep — not a standalone commit)
+
+### State at end of session
+
+- Working tree clean.
+- Prod files bit-for-bit match HEAD across 18 spot-checked files.
+- `pm2 norma-email` online on `:7400`, saved.
+- 6 users active (admin, info@, natalia, sabrinaashley, sabrinacalazans, ryan); 22 perms in `role_permissions`; 3 mailboxes (natalia connected with 1,915 msgs; info@ + sabrinaashley placeholders).
+- Disk: 689 GB usable, 299 GB free.
+- No git remote (per `feedback_never_push_to_remotes.md`).
diff --git a/docs/sessions/tasks-completed.md b/docs/sessions/tasks-completed.md
index 00741bf..441618c 100644
--- a/docs/sessions/tasks-completed.md
+++ b/docs/sessions/tasks-completed.md
@@ -76,3 +76,60 @@ Tasks fully implemented and deployed.
 - `.gitignore`: `/node_modules` → `node_modules/`, `/.next/` → `.next/`
 - Verified via `git check-ignore`
 - Commit: `76d5881`
+
+## 2026-05-20 (PT) — Roles, perms matrix, modal fan-out, Gmail per-user, disk save
+
+### Request #42-47: Three-tier login, perms matrix, modal resize, SDCC user seed
+- Migration: `db/024_user_management.sql` — `intern` added to role enum; new cols `full_name`, `email`, `is_active`, `last_login_at`, `created_by`; new `role_permissions` table with 22 seeded feature_keys across 8 categories (gmail/drafts/petitions/contacts/news/grants/outreach/social/settings).
+- Auth lib: `lib/auth.ts` — `UserRole` union + `ALL_ROLES` + `ROLE_LABEL` exports; updated literal types across `AuthProvider`, `Sidebar`, `pulse/layout.tsx`.
+- Permissions: `lib/permissions.ts` — `hasPermission(role, feature)` reader with 60 s in-process cache + `clearPermissionsCache()` invalidator; admin bypasses gates.
+- API: `/api/admin/permissions` GET/PUT (admin-only matrix editor with batched writes); `/api/settings/tier-credentials` POST/PUT accept full_name/email/is_active and refuse to disable or demote the admin row; `/api/auth/login` blocks `is_active=false` AFTER password check + bumps `last_login_at` + returns `fullName`.
+- UI: `CredentialsSection` got Full Name / Email / Active toggle / Intern role option + a collapsible per-user permissions row keyed off the live `role_permissions` matrix. New `PermissionsMatrix` component (checkbox grid feature × role) mounted in SettingsTab.
+- Shared modal: `components/shared/ResizableModal.tsx` — full-screen toggle, bottom-right drag handle, localStorage per-modalId size persistence. CredentialsSection's User Create/Edit + Delete Confirm retrofitted as the proof point.
+- Seeded users: `admin/NormaAdmin2026!`, `info@studentdebtcrisis.org/Norma!SCYxIvWR`, `natalia/Norma!0YEjGfn2`, `sabrinaashley/Norma!z83W02Lk`, `sabrinacalazans/Norma!Sj4tvIpz`, `ryan/Norma!flw7uyxd`. All non-admin SDCC users pinned to `Student Debt Crisis Center` org. Temp passwords logged to `docs/sessions/NORMA-NEW-USERS-2026-05-20.md` (gitignored).
+- Commits: `f6b2dba` (auth+perms+UI), `d433048` (ResizableModal).
+
+### Request #48: Fan ResizableModal out across the project
+- 4 parallel `claude --print` subprocesses via the `max-it` skill; each refactored ~8 files.
+- 22 modals across 15 files converted: ApiCredentialsSection (4) · ManageTabsModal · AddGrantModal · AddPetitionModal · ScheduleModal · MemberEmailModal · BulkScheduleModal · CompareModal · ContactsTab · InTheNewsTab · JournalistHub (2) · OldLeadsTab · ApiRegistryModal · LibraryTab · AdvocacyTargets · XSessionsTab · StatementsTab · PartnersTab · OnBoardTab (2) · OutreachPlaybookTab (2) · SocialTab (2) · PlatformPreview (2) · ComposeModal.
+- Workers correctly skipped non-modal files (PetitionDraftModal as a side-drawer; PipelineTab/PetitionsTab/etc that delegate to external modals; DashboardTab/PulseFeed/TopicRadar/NetworkGraph3D/EnhancedMindMap/PulseGlobe — no centered modals).
+- Commit: `ee9135a`.
+
+### Request #49-50: Per-user Gmail scoping + admin union
+- `/api/auth/session`: returns `email`, `fullName` from `tier_credentials` (with username fallback when shaped like an email).
+- `/api/gmail/messages`: resolves mailbox via the authed user's email; returns `needs_connect: true` when no row OR `oauth_tokens IS NULL`. Admin default = UNION of every connected mailbox. `?mailbox=own` / `?mailbox=<id>` / `?mailbox=all` are explicit overrides.
+- `GmailCRMTab`: header binds to `sessionEmail`; shows amber "Gmail not connected" + green Connect Gmail → pill; empty inbox renders a prominent CTA when `needs_connect && sessionEmail`.
+- Placeholder mailbox rows seeded for info@ + sabrinaashley@ (`needs_reauth=true`). Duplicate uppercase-Natalia mailbox row deleted; `tier_credentials.email` normalized to lowercase for natalia + sabrinaashley.
+- Commit: `8f71b14`.
+
+### Request #51: info@ added to weekly intelligence digest
+- `nonprofit_accounts.api_connections.intelligence = {digest_enabled:true, digest_day:'monday', digest_email:'info@…, natalia@…, SabrinaAshley@…', cron_enabled:true}` for the SDCC org.
+
+### Request #52: Admin impersonation backend
+- `app/api/admin/impersonate/route.ts`:
+  - GET — returns current impersonation state.
+  - POST `{username}` — admin-only. Mints a fresh session token for the target, swaps `norma-auth` to that token, and preserves the admin's original token in `norma-imp-by` cookie (24h).
+  - DELETE — anyone holding `norma-imp-by` can exit cleanly; restores `norma-auth` from it and clears `norma-imp-by`.
+- UI dropdown / banner: TODO.
+
+### Request #53: Connect-Gmail flow per-mailbox
+- `lib/gmail.ts`: `getAuthUrl(mailboxEmail?, state?)` now takes a target email + uses it as both `login_hint` and `state`. `storeTokens(tokens, mailboxEmail, displayName?)` upserts case-insensitively into the named row, clears `needs_reauth`, sets `is_active=true`. `getStoredTokens(mailboxEmail?)` reads per-mailbox.
+- `/api/gmail/oauth`: GET resolves the mailbox (explicit `?mailbox=` → tier_credentials email → username if email-shaped); admin can OAuth any mailbox; non-admins restricted to their own. Renders a tailored consent page with hidden `<input name="mailbox">` so the POST exchange knows where to land tokens.
+- `/api/gmail/oauth/callback`: reads `state` from the redirect to know which row to update.
+
+### Request #54: SDCC team OAuth handoff doc
+- `docs/CONNECT-GMAIL-INFO-SDCC.txt` — 9-step click-through (login → Connect Gmail → consent → callback paste → verify sync) plus two known-blocker branches (GCP project still "Testing" → add info@ to test users; Workspace admin restricting third-party apps → allowlist OAuth client). Linter sweep redacted the inline temp password.
+
+### Request #55: Kamatera disk save
+- Cleared 6.2 GB on the fly when PG crashed (full disk): removed my own broken-rsync backup at `/root/Projects/Norma.broken-20260520` (2.2 GB), `pm2 flush` (1.6 GB), `journalctl --vacuum-time=3d` (3.6 GB), truncated `/var/log/service-monitor.log`, `/var/log/syslog`, `/var/log/auth.log`. PG cluster restarted clean.
+- Kamatera disk grown 400 → 700 GB by Steve via the panel. After reboot ran `growpart /dev/sda 2 && resize2fs /dev/sda2`; filesystem is now 689 GB usable, 299 GB free.
+
+### Request #56: Top-bar (theme + age + impersonate)
+- Theme switcher (`InboxThemeBanner` + `InboxThemeSwitcher`) and age slider (`AgeThemeSlider`) already mounted ABOVE the AppShell header; commits `70fa5dc`, `82446f2`, `ce205d8`, `c498d02` polish those.
+- Impersonate dropdown: backend exists, UI not yet wired.
+
+### Request #57: Reset admin password
+- `admin / NormaAdmin2026!`.
+
+### Request #58: Commit + push everything
+- 11 fresh commits today, all local. No remote per `feedback_never_push_to_remotes.md`. Prod files bit-for-bit match HEAD across all spot-checked paths.
diff --git a/docs/sessions/tasks-requested.md b/docs/sessions/tasks-requested.md
index 3cc4d10..1eea8bb 100644
--- a/docs/sessions/tasks-requested.md
+++ b/docs/sessions/tasks-requested.md
@@ -80,3 +80,19 @@ Track every task the user has requested, regardless of completion status.
 | 45 | Seed 4 SDCC users: Natalia + SabrinaAshley (admin), sabrinacalazans (user), Ryan (intern) | DONE |
 | 46 | Modal should be resizable (drag handle) + full-width toggle | DONE (CredentialsSection done; fleet retrofit pending) |
 | 47 | Retrofit remaining 50+ modals to ResizableModal | PENDING |
+
+## 2026-05-20 (PT) — continuation session
+
+| # | Request | Status |
+|---|---------|--------|
+| 48 | Fan ResizableModal out to the remaining ~50 modals | DONE — 22 modals across 15 files retrofitted (commit ee9135a). Skipped non-modal files (drawers/dropdowns/toasts) with reasons logged. |
+| 49 | Stop the Gmail CRM header from saying natalia@ when logged in as info@ — bind to the logged-in user | DONE — `/api/auth/session` returns email + fullName; `GmailCRMTab` binds to `sessionEmail` (commit 8f71b14). |
+| 50 | Add `info@studentdebtcrisis.org` as the main SDCC admin that can see everyone else's accounts | DONE — admin tier, full visibility; `/api/gmail/messages` now defaults admins to the UNION of every connected mailbox so info@ sees 1,915 SDCC msgs immediately. |
+| 51 | Add info@studentdebtcrisis.org to the weekly intelligence digest recipients | DONE — `nonprofit_accounts.api_connections.intelligence.digest_email` = `info@, natalia@, SabrinaAshley@`; `digest_enabled=TRUE`, day=Monday. |
+| 52 | Admin impersonation — toggle through each user and act as their account | PARTIAL — backend shipped at `/api/admin/impersonate` (GET/POST/DELETE with `norma-imp-by` cookie preservation). UI dropdown + banner not yet wired. |
+| 53 | "Connect Gmail" UX so info@ can OAuth their own Google account | DONE — green pill in header + big CTA in empty inbox state, links to `/api/gmail/oauth?action=connect&mailbox=<email>`. lib/gmail.ts + /api/gmail/oauth refactored to per-mailbox. |
+| 54 | Doc for the SDCC team member with info@'s Google password | DONE — `docs/CONNECT-GMAIL-INFO-SDCC.txt` (9 steps + 2 likely Google-side blockers + troubleshooting). |
+| 55 | Grow Kamatera disk + claim the new space | DONE — Kamatera resized 400→700 GB; `growpart /dev/sda 2 && resize2fs /dev/sda2`; filesystem now 689 GB usable, 299 GB free (was 5.7 GB free). |
+| 56 | Theme + age slider + impersonate dropdown all at the very top of the app | PARTIAL — theme + age are already at the top (`InboxThemeBanner` + `AgeThemeSlider` above the header). Impersonate dropdown TODO. |
+| 57 | Reset admin password to something memorable | DONE — `admin / NormaAdmin2026!`. |
+| 58 | Commit + "push" everything | DONE locally — 11 fresh commits today, prod files bit-for-bit match HEAD. No remote per `feedback_never_push_to_remotes.md`; confirmed with Steve to stay local-only. |

← 11bcabc docs+infra: gmail connect note (password redacted) + linter-  ·  back to Norma  ·  feat(impersonate): wire the View-as dropdown + Acting-as ban 1c1e1df →