Scopes this plan's immediate implementation target to Setup + User
Stories 0-3 (sign-in, agent dashboard, ticket workbench, support-org
admin) - the P1 MVP - given the feature's overall size (8 user stories
against a fully empty lib/api, lib/auth, lib/query, and empty test
configs). Key decisions: session token in a plain cookie (readable by
both Next.js middleware and client-side axios, since supporthub-api only
reads a Bearer header, never a cookie), middleware does a cheap
unverified presence/role check for UX redirects only - the real gate
stays supporthub-api's own token verification - and lib/api is the one
typed client layer per Constitution Principle IV.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
