feat(org): 成员目录 —— Keycloak 读写面穿透、治理台成员/组织/权限三页、姓在前 personName、Staff.kind

后端:`KeycloakDirectory` 端口(users / groups / roles 读写;写直接穿透 Keycloak —— 这里建的人立刻能登录、
删的人立刻消失,停用与收权之后 logout 踢掉会话)、`keycloak-directory.ts` + `keycloak-admin-http.ts` 适配器、
org-directory 契约与 /api/gov 路由、`sync-roster` CLI(ops 路由够不着时整册照过来),
容器按 provisioning 服务账号有无决定注不注入(没配就如实说不可用)。
`personName` 姓在前:汉字直拼「柴浩」、否则留一个空格「Admin Amy」,token 与名册同步两条路同一把尺;
`staffKindOf` 按 Keycloak 固定前缀 service-account- 认服务账号,员工那一屏不摆它(`Staff.kind` 不落库,按账号名现判)。
前端:员工那一屏重做成成员 / 组织 / 权限三页签(member-page 下钻),页签栏右端一句话说清这一格管什么。
契约变更:contracts org.ts / api/http.ts / api/org-directory.ts;api-report 已刷新;org CONTRACT.md 与 ADR-012 同步。
2026-08-26 做的,一直留在工作树没入库。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0167qWjeyBwvfdGovd7FWbCu

api-report/packages/contracts/src/api/workbench.d.ts

@@ -20,6 +20,10 @@ export declare const sessionRoute: {
                 disabled: "disabled";
             }>>;
             roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            kind: z.ZodDefault<z.ZodEnum<{
+                person: "person";
+                service: "service";
+            }>>;
         }, z.core.$strip>;
         position: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
@@ -80,6 +84,10 @@ export declare const loginRoute: {
                 disabled: "disabled";
             }>>;
             roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            kind: z.ZodDefault<z.ZodEnum<{
+                person: "person";
+                service: "service";
+            }>>;
         }, z.core.$strip>;
         position: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
@@ -158,6 +166,10 @@ export declare const meRoute: {
                 disabled: "disabled";
             }>>;
             roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            kind: z.ZodDefault<z.ZodEnum<{
+                person: "person";
+                service: "service";
+            }>>;
         }, z.core.$strip>;
         position: z.ZodObject<{
             id: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
@@ -891,6 +903,7 @@ export declare const taskDetailSchema: z.ZodObject<{
             cols: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
         }, z.core.$strip>>;
         submitLabel: z.ZodOptional<z.ZodString>;
+        gateLedgers: z.ZodOptional<z.ZodArray<z.ZodString>>;
         gate: z.ZodOptional<z.ZodObject<{
             ready: z.ZodBoolean;
             why: z.ZodString;
@@ -1475,6 +1488,7 @@ export declare const taskDetailSchema: z.ZodObject<{
             cols: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
         }, z.core.$strip>>;
         submitLabel: z.ZodOptional<z.ZodString>;
+        gateLedgers: z.ZodOptional<z.ZodArray<z.ZodString>>;
         gate: z.ZodOptional<z.ZodObject<{
             ready: z.ZodBoolean;
             why: z.ZodString;
@@ -2796,6 +2810,7 @@ export declare const taskDetailRoute: {
                 cols: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
             }, z.core.$strip>>;
             submitLabel: z.ZodOptional<z.ZodString>;
+            gateLedgers: z.ZodOptional<z.ZodArray<z.ZodString>>;
             gate: z.ZodOptional<z.ZodObject<{
                 ready: z.ZodBoolean;
                 why: z.ZodString;
@@ -3380,6 +3395,7 @@ export declare const taskDetailRoute: {
                 cols: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
             }, z.core.$strip>>;
             submitLabel: z.ZodOptional<z.ZodString>;
+            gateLedgers: z.ZodOptional<z.ZodArray<z.ZodString>>;
             gate: z.ZodOptional<z.ZodObject<{
                 ready: z.ZodBoolean;
                 why: z.ZodString;