Converge modular SaaS platform foundations

[AntoineToussaint]

Outcome

Converges the current SaaS Starter work into one tested, publishable foundation for Warden and future Codefly products.

Highlights

• adds permissions-plugin-owned Work Context authority and audience exchange
• adds schema-agnostic typed settings runtimes for Go and TypeScript over ProtoJSON storage
• hardens Postgres role boundaries, auth bootstrap concurrency, RLS, and test dependency lifecycle
• completes generated gRPC, Connect, REST, OpenAPI, authz, topology, and frontend catalogs
• strengthens the compile-time frontend plugin contract and constrained plugin BFF
• moves the Next.js app to server-first route shells and current secure dependencies
• refreshes fixtures, docs, release gates, and canonical base integrity
• consumes released Core v0.2.47, Go agent v0.1.21, and service-postgres v0.0.107
• runs independent package-owned dependency stacks concurrently with kernel-assigned ports instead of serializing tests

Validation

• root module agent, Accounts, and auth-sidecar Go suites pass with GOWORK=off
• Accounts parallel package run passes all four real SDK-managed Docker dependency stacks without GOFLAGS=-p=1
• Go vet passes across all Go modules
• auth first-login convergence passes 10 consecutive concurrent runs
• 60 Vitest files / 414 tests pass
• TypeScript typecheck and ESLint pass (warnings only for known compiler-incompatible third-party hooks)
• Next.js production build passes
• npm production audit reports zero vulnerabilities
• generated outputs are byte-stable on regeneration
• Codefly verify and base-integrity checks pass
• Warden local-source module-sync preview converges with the exact 46 reviewed upstream resolutions and zero remaining collisions