feat(shell): console shell from the October 2026 redesign (#900)

[alex-dembele]

First screen of the redesign epic (#899): the shell every other page sits in.

What changed

• Sidebar rebuilt on the design's measurements (surface-1, 34px entries, accent keyline on the active one, divider under the pinned dashboard, bordered org card, 36px new-risk button). Copy follows the design: Recommandations, Rôles et accès, Administration. Recommendations and Emerging risks get the lightbulb and radar icons.
• Sidebar badges are the design's four, each from a tenant-scoped endpoint and only fetched when the member can open the screen: action items, KEV flaws still open, open incidents, pending invitations.
• Backend: GET /vulnerabilities/stats gains kev_open (KEV and still open, triaged or in remediation). kev_count keeps its meaning. Repository tests cover success, empty tenant and cross-tenant isolation.
• Header blends both designs: the redesign's bar (breadcrumb, 300px search, theme, notifications, help) plus our connection dot, language switch and density. The keyboard button became the design's help button and opens the same shortcuts sheet. The breadcrumb starts at the intention group as in the design.
• Notifications panel at the design's size and surfaces, red unread count, footer link to the activity feed.
• Command palette in the design's order (actions, "Aller à", results) with real arrow-key navigation; results show severity and status as words.
• Page frame and title block on the design metrics (1320px column, 24/32/64 padding, 28px display title with eyebrow and subtitle). Avatars become the design's neutral disc. Canvas is surface-0.

Bugs found on the way, fixed here

• Cmd/Ctrl+K did nothing until the palette had been opened once, because the palette registered the shortcut itself and is mounted lazily.
• On mobile, the navigation drawer slid under the sticky header.

Verified

• npx tsc -b --noEmit: clean.
• npx vitest run: 112 files, 1034 tests passed.
• node scripts/check-lint-ceiling.mjs: 97 errors against a ceiling of 99, ceiling lowered to 97.
• go test ./internal/infrastructure/repository/ ./internal/application/dashboard/ ./internal/application/vulnerability/ ./internal/handler/: ok.
• Live, Vite on a throwaway backend, side by side with the design at 1440×900 in dark and light: sidebar, header, notifications panel, palette (empty, filtered, Cmd+K open and toggle). 414px: no horizontal overflow, drawer above the header. 1440×600 checked.
• axe-core on header and sidebar, dark and light: 0 serious or critical.

Not done here

• Density stays in the header until the Settings page gets its Apparence section (feat(frontend): settings combining the redesign and today's screen #924), where the design puts it.
• The design's org subtitle reads "Entreprise · Dakar"; we show the plan, because the organization has no city field.

Closes #900