feat(ui): add auth pages, company rail, inbox redesign, and page improvements

Add Auth sign-in/sign-up page and InviteLanding page for invite acceptance.
Add CloudAccessGate that checks deployment mode and redirects to /auth when
session is required. Add CompanyRail with drag-and-drop company switching.
Add MarkdownBody prose renderer. Redesign Inbox with category filters and
inline join-request approval. Refactor AgentDetail to overview/configure/runs
views with claude-login support. Replace navigate() anti-patterns with <Link>
components in Dashboard and MetricCard. Add live-run indicators in sidebar
agents. Fix LiveUpdatesProvider cache key resolution for issue identifiers.
Add auth, health, and access API clients.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ui/src/api/access.ts

@@ -0,0 +1,52 @@
+import type { JoinRequest } from "@paperclip/shared";
+import { api } from "./client";
+
+type InviteSummary = {
+  id: string;
+  companyId: string | null;
+  inviteType: "company_join" | "bootstrap_ceo";
+  allowedJoinTypes: "human" | "agent" | "both";
+  expiresAt: string;
+};
+
+type AcceptInviteInput =
+  | { requestType: "human" }
+  | {
+    requestType: "agent";
+    agentName: string;
+    adapterType?: string;
+    capabilities?: string | null;
+    agentDefaultsPayload?: Record<string, unknown> | null;
+  };
+
+export const accessApi = {
+  createCompanyInvite: (
+    companyId: string,
+    input: {
+      allowedJoinTypes?: "human" | "agent" | "both";
+      expiresInHours?: number;
+      defaultsPayload?: Record<string, unknown> | null;
+    } = {},
+  ) =>
+    api.post<{
+      id: string;
+      token: string;
+      inviteUrl: string;
+      expiresAt: string;
+      allowedJoinTypes: "human" | "agent" | "both";
+    }>(`/companies/${companyId}/invites`, input),
+
+  getInvite: (token: string) => api.get<InviteSummary>(`/invites/${token}`),
+
+  acceptInvite: (token: string, input: AcceptInviteInput) =>
+    api.post<JoinRequest | { bootstrapAccepted: true; userId: string }>(`/invites/${token}/accept`, input),
+
+  listJoinRequests: (companyId: string, status: "pending_approval" | "approved" | "rejected" = "pending_approval") =>
+    api.get<JoinRequest[]>(`/companies/${companyId}/join-requests?status=${status}`),
+
+  approveJoinRequest: (companyId: string, requestId: string) =>
+    api.post<JoinRequest>(`/companies/${companyId}/join-requests/${requestId}/approve`, {}),
+
+  rejectJoinRequest: (companyId: string, requestId: string) =>
+    api.post<JoinRequest>(`/companies/${companyId}/join-requests/${requestId}/reject`, {}),
+};