feat(operator): design system port + persistent shell (O.4)

Operator portal now wears its real chrome instead of placeholder spans.
Sidebar + topbar + page header all rendered against the carbon palette
from tokens.css.

Components ported from the source design (operator-app.jsx,
platform-ui.jsx, operator-screens.jsx) as Vue 3 SFCs in
apps/operator/components/:

  Foundation: NodeMark (copied from portal), UiIcon (expanded to 31 icons
  covering sidebar/topbar/sort/arrows)

  Primitives: Card (3 surface variants), UiButton (primary / secondary /
  ghost / dark / danger × sm / md / lg), DataTable (header + rows),
  Badge (7 tones), Avatar (deterministic palette by name hash), Mono,
  Eyebrow, StatusDot, PageHeader (with actions slot)

  Shell: OpSidebar (collapsible 232<->56px, 12 nav items in 4 sections,
  active-row highlight from route, badge slot, brand + user footer);
  OpTopbar (env badge with prod/staging/dev variants, palette trigger
  stub for the ⌘K work in O.8, on-call pill, bell, avatar)

Layouts: layouts/default.vue wires sidebar + topbar + slot; layouts/blank.vue
is used by the login page (definePageMeta layout:'blank'). app.vue now
wraps NuxtPage in NuxtLayout (the missing piece — without it Nuxt warns
"Your project has layouts but the <NuxtLayout /> component has not been
used" and renders nothing chrome-wise).

Composable composables/useSidebar.ts holds the collapsed state shared
between OpSidebar's toggle button and layouts/default.vue's ⌘[ keyboard
shortcut.

Verified in the browser:
  - Sidebar renders all 12 nav links with section dividers, env badge shows
    PROD, PageHeader resolves to the user's display name from
    useOidcAuth().user
  - Collapse toggle flips sidebar width 232↔56; nav rows become icon-only
  - Smoke test on the placeholder home still returns 409 for the seeded
    test-partner (token forwarding survives the layout refactor)

Gotcha documented in the plan: Vite 7.3 added a strict
server.allowedHosts check that returns plaintext 403 for any host header
that isn't the dev origin. The customer portal pre-dates this Vite
version; operator needs allowedHosts: ['operator.dezky.local'] in
nuxt.config.ts under vite.server.

Pages/index.vue replaces the bare HTML placeholder from O.3 with the
new PageHeader + Card primitives — same smoke-test functionality, much
better visual fidelity.

Real screen content (Tenants, Partners, Infrastructure, etc.) lands in
O.5+. This commit is the chrome, the smoke test, and the verification
that the design system primitives compose correctly.

apps/operator/layouts/default.vue

@@ -0,0 +1,62 @@
+<script setup lang="ts">
+// Default operator chrome: persistent sidebar + topbar wrapping a scrollable
+// content slot. Pages that should render WITHOUT chrome (the login screen)
+// set `definePageMeta({ layout: 'blank' })`.
+
+const route = useRoute()
+const { toggle } = useSidebar()
+
+// Derive the active nav row from the route. Matches OpSidebar's `id` keys.
+const currentNav = computed(() => {
+  const p = route.path
+  if (p === '/') return 'overview'
+  if (p.startsWith('/tenants')) return 'tenants'
+  if (p.startsWith('/partners')) return 'partners'
+  if (p.startsWith('/users')) return 'users'
+  if (p.startsWith('/support')) return 'support'
+  if (p.startsWith('/billing')) return 'billing'
+  if (p.startsWith('/reports')) return 'reports'
+  if (p.startsWith('/infrastructure')) return 'infra'
+  if (p.startsWith('/flags')) return 'flags'
+  if (p.startsWith('/audit')) return 'audit'
+  if (p.startsWith('/operator-team')) return 'team'
+  if (p.startsWith('/settings')) return 'settings'
+  return ''
+})
+
+// Keyboard shortcut: ⌘[ toggles sidebar. ⌘K palette lands in O.8.
+onMounted(() => {
+  const onKey = (e: KeyboardEvent) => {
+    if ((e.metaKey || e.ctrlKey) && e.key === '[') {
+      e.preventDefault()
+      toggle()
+    }
+  }
+  document.addEventListener('keydown', onKey)
+  onBeforeUnmount(() => document.removeEventListener('keydown', onKey))
+})
+</script>
+
+<template>
+  <div class="shell">
+    <OpSidebar :current="currentNav" />
+    <main>
+      <OpTopbar />
+      <div class="content">
+        <slot />
+      </div>
+    </main>
+  </div>
+</template>
+
+<style scoped>
+.shell {
+  display: flex;
+  min-height: 100vh;
+  background: var(--bg);
+  color: var(--text);
+}
+
+main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.content { flex: 1; min-width: 0; overflow-y: auto; }
+</style>