feat(lock): org-enforced lock policy (#510)

[kipavy]

Client half of the org-enforced lock policy (#510, spec 3 of 3). Needs VoltiusApp/server#101 deployed first.

What it does

A Business team admin (Manage vault or Administrator) sets a maximum auto-lock time and can require Lock vault. Every member's app follows it, owner and admins included.

• Members → Security side panel, also reachable from the vault menu ("Security policy…"). Each change saves straight away. Below Business, an existing policy stays enforced and can only be removed; with no policy the panel shows the Business upsell card.
• Settings → Account → Session security shows the effective values: looser auto-lock choices are hidden, Lock screen is unavailable when Lock vault is required, and a line names the team ("Set by Acme: at most 15 minutes."). The account menu's auto-lock hint uses the same effective value.
• The member's own choices are never rewritten. Removing the policy or leaving the team brings them back.
• With several teams the strictest wins: shortest time, Lock vault if any team requires it.
• Works offline: the combined policy is cached per account (same parking as the other account-scoped stores, so switching and signing out handle it) and refreshed after every successful team fetch.

Other changes in this branch

• listTeams() now throws on a non-OK response instead of returning []. A 401/500/429 used to look like "no teams", which would clear the cached policy and could make a membership event read as removal from every team.
• Members page keeps one side-panel state instead of a boolean per panel, and uiStore has one membersPanelPending instead of a pair of flags per panel.
• BusinessLockCard extracted from the Roles panel and reused by the Security panel; VAULT_MANAGER_BITS shared by the vault menu and the Members page.
• Fix (spec 1): after Lock vault, a cloud account that had never saved a secret (no secrets.enc) reloaded into onboarding instead of the unlock page. The splash now treats server mode as locked; unlocking re-authenticates with the server as before.

Testing

• vitest, per directory: settings/sections, layout, i18n, hooks, stores, members, vault-admin, services touched; all green. tsc --noEmit clean.
• Live, two real accounts on a private self-hosted server running server#101:
  1. Owner set "5 minutes, require Lock vault" in the Security panel; the member's Session security updated over the realtime push with no reload.
  2. Member (own choice: Never, Lock screen) was vault-locked 5 minutes after the last input.
  3. Server stopped, member cold-started: policy applied from the cache, the label fell back to "your team", and the offline idle lock showed the unlock page.
  4. Owner removed the policy: member back to Never and Lock screen.
  5. Hosted mode with the owner on Teams: the lapse notice froze the controls, removal returned 204, and the upsell card appeared.
     Membership was added in the database rather than through the invite flow.

Release notes owed

• CHANGELOG: "Business teams can set a maximum auto-lock time and require Lock vault for every member (Members → Security)." and "Self-hosters: update the server together with the app to use lock policies."
• Docs (team page, pricing row, self-hosting update line) and the web plans line follow in their own PRs.

Known follow-ups (not in this PR)

• Mobile sign-out keeps the previous policy in memory until restart (errs strict).
• The Security panel stays open after switching the Members vault tab to a team you don't manage; its controls then return 403.
• Audit log shows team.lock_policy_set / team.lock_policy_removed as raw event names.
• No admin-side warning for Immediately + Require Lock vault (members already get one).