Sidebar permissions & design unification

Sidebar visibility and server route authorisation were maintained separately, so they drifted. Links appeared that the server would reject, and modules were reachable that no link pointed to. Inventory was buried inside another module rather than standing on its own.

• A single access predicate governs both sidebar visibility and route authorisation, so a visible link always resolves.
• The per-role target matrix was reviewed and approved before implementation.
• Inventory became its own module, and a Telegram entry was added.
• The sidebar rail was rebuilt on the DESIGN.md board tokens: mono group labels, an amber lamp dot on the active sub-link, and the active group auto-opened on render.
• Verification recorded 730 unit tests passing and a five-of-five role audit under Playwright.

Plan

docs/superpowers/plans/2026-09-11-sidebar-permissions-and-design-plan.md