Validation: #107 Role-based tabs, route enforcement, audit trail

Validation: #107 Role-based tab visibility, route enforcement, and audit trail

Checks

• PASS — Global authenticate_user! enforced when Keycloak configured, skipped in dev mode
• PASS — require_role DSL applied per controller: member+ for Today actions, lead+ for Properties/Uploads, admin+ for Weeks/Crew
• PASS — SessionsController and ClientErrorsController skip auth (login/error reporting must work unauthenticated)
• PASS — 5-slot CSS grid nav with Person always centered in slot 3 regardless of visible tabs
• PASS — "New" and "Photos" tabs removed from nav as specified
• PASS — Client role sees friendly "contact your administrator" message at root instead of redirect loop
• PASS — PaperTrail audit trail on Property, Service, Upload, WorkQueueItem with whodunnit tracking
• PASS — object_changes column added for per-field audit diffs
• PASS — Crew controller placeholder (admin/super_admin only)
• PASS — Dev mode graceful degradation — all routes open, all tabs visible without Keycloak env vars
• PASS — 141 specs passing (101 existing + 40 new), 0 failures
• PASS — CSS follows ~/ror-css-guide: design tokens, component comments, semantic naming, no inline styles

QA Fixes Applied Before Merge

• Added object_changes column to PaperTrail migration (stores per-field diffs for readable audit trail)
• Switched nav from flexbox to CSS grid with fixed nav-slot-N classes (Person stays centered for all role layouts)

Discovered Scope

• #137 — Person icon currently links to root_path (same as Today). Needs its own My Profile / My Property views. Created and added to board as phase:2.