supporthub-api's 010-identity-auth (built after this spec's initial approval)
established that agent/admin login is supporthub-api's own authentication,
never SaaS-delegated — this spec and the project constitution's Principle I
still assumed the opposite. Adds User Story 0 (sign-in, P1) and FR-000/SC-006
for the login screen and session-guard this frontend must now own, and
rewords FR-011/the affected Edge Case to reference the supporthub-api
session role instead of a "SaaS-provided role." Only end-customer identity
remains SaaS-delegated.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
