feat(KLEF-204): User/Org Entity Unification And Project Flow Refactoring

[JeremyNRoos]

Pull Request

Summary

• Refactors the entire server management model from project/environment-scoped to namespace-scoped: servers now belong to a namespace directly, eliminating the project/environment intermediary for simple deployments
• Replaces the project-gated servers page with a unified SimpleServersPage that works in both namespace mode (personal/shared namespaces) and project mode
• Adds filter tabs (All / Game Servers / Databases / etc.) with KIND_META + inferKind for automatic server classification, and blueprint background images + crate logos sourced from the catalog API
• Replaces CreateServerModal with CreateServerPalette — a full-screen palette with category browsing
• Adds canvas group nodes (stacks) for visually grouping servers on the infrastructure graph, with group management modal, drag-to-add, fit-to-members, auto-arrange, and persistent positions
• Overhauls the sidebar from a project-centric tree to a Vercel-style personal hub sidebar with namespace switching
• Fixes pnpm 11 incompatibilities that were breaking the Next.js Docker build

Related Issues

Closes #

---

Changes

What's Included

API — Go

• domain/workload.go — NamespaceID field on Workload
• ports/repository.go — FindByNamespaceAndName and ListByNamespace added to Repository interface
• ports/spec.go — NamespaceSlug field on WorkloadSpec for container naming
• adapters/persistence/store.go — FindByNamespaceAndName and ListByNamespace implemented; 20-column schema with namespace_id, game_version, modloader; ListByNamespace excludes deleted state
• adapters/http/handler.go — namespace-scoped routes (GET /namespaces/:ns/workloads, DELETE /namespaces/:ns/workloads/:name); ensureEnvironmentAccess replaces ensureProjectAccess on workload routes
• bootstrap/container.go + http.go — wires namespace workload handler, routes, usage handler, and plugin manager
• bootstrap/config.go — metrics sink and plugin registry URL config
• core/users/ — avatar upload, profile fields, user domain updates
• core/logs/ — log domain and handler updates
• core/usage/ — usage tracking handler and store
• shared/middleware/auth.go, plugin_verifier.go — auth and plugin verification updates

Web — Next.js / React

• lib/api/projects.ts — listWorkloadsByNamespace, deleteWorkloadFromNamespace; updated workload DTO
• lib/api/ — updated logs, usage, deployments, profiles, organizations clients
• features/hosting/pages/SimpleServersPage.tsx — unified namespace + project mode, filter tabs, KIND_META/inferKind, CreateServerPalette, blueprint backgrounds and crate logos from catalog
• features/hosting/ui/GroupNode.tsx — dark glass panel (rgba(11,12,16,0.88) + backdrop-blur(12px)), 3px colored left border accent, portal-based dropdown (position: fixed, zIndex: 9999) escaping ReactFlow stacking context
• features/hosting/ui/InfrastructureFlowCanvas.tsx — auto-arrange grid stride from actual rendered node dimensions; group drag-to-add with undo toast
• features/hosting/model/useCanvasGroups.ts — full canvas group model: create, update, delete, fit-to-members, auto-arrange, persistent positions
• features/hosting/ui/GroupManagerModal.tsx — group create/edit modal with label, color picker, role, notes
• features/hosting/ui/GroupEventContext.tsx — event context wiring GroupNode actions to canvas handlers
• features/hosting/ui/NodeDetailsPanel.tsx — expanded node details panel
• features/hosting/ui/NewServerSheet.tsx, CreateServerModal.tsx — updated server creation flows
• features/hosting/ui/InfrastructureNodeCard.tsx, LogViewer.tsx, RegionBadge.tsx, StatusBadge.tsx — updated node card and supporting components
• lib/infrastructure-graph.ts — graph layout and group persistence
• components/layout/PersonalHubSidebar.tsx — new Vercel-style namespace sidebar replacing project-tree sidebar
• components/layout/AppShell.tsx, SidebarUserFooter.tsx, PersonalHubShell.tsx — shell and footer updates
• components/layout/Sidebar.tsx — removed (replaced by PersonalHubSidebar)
• app/globals.css — global style refresh
• features/dashboard/, features/auth/, features/settings/, features/plugins/, features/projects/ — updated for new nav and namespace model
• web/package.json, pnpm-workspace.yaml, Dockerfile.dev — pnpm 10 pin, node-linker, build script allowlist for pnpm 11 compat

What's Not Included

• Namespace creation / management UI (exists in the settings flow, not changed here)
• Group node drag animation polish (deferred)
• Daemon-side namespace provisioning (companion PR in kleffio/daemon)

---

Testing

How Was This Tested?

• Go API built cleanly with go build ./... after all persistence and domain changes
• Namespace mode: workloads listed correctly by namespace slug, delete and refetch work end-to-end
• Filter tabs: each category narrows correctly using inferKind; "All" shows full list
• Canvas groups: create, rename, change color, drag servers in/out, auto-arrange snaps to grid and expands group bounds, fit-to-members shrinks to content, dropdown renders above server cards at all zoom levels
• Personal hub sidebar: namespace switching, avatar, user footer all working
• make dev-clean + make dev full stack verified

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

If yes, describe the impact and any required migration steps:

The Repository interface gains two new methods (FindByNamespaceAndName, ListByNamespace) — any other implementations of this interface must add these methods. The workloads persistence schema requires the namespace_id, game_version, and modloader columns (migration 023 adds these). The old project-tree sidebar is removed and replaced; any route that relied on the old sidebar nav layout will need to be re-verified.

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

If any box is checked, describe the security impact and any mitigations applied:

Namespace-scoped workload routes use ensureEnvironmentAccess which enforces that the caller has access to the namespace before listing or deleting workloads. No workload data is exposed without a valid authenticated session.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

If yes, check all that apply:

• README.md
• ARCHITECTURE.md
• API reference
• Architecture diagrams (C4 / DDD)
• /docs

---

UI/UX (If Applicable)

• Includes new components or views
• Changes styles or theme tokens
• Responsive behavior verified
• Requires design approval

Screenshots or recordings:

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes