feat(operator): design system port + persistent shell (O.4)

Operator portal now wears its real chrome instead of placeholder spans.
Sidebar + topbar + page header all rendered against the carbon palette
from tokens.css.

Components ported from the source design (operator-app.jsx,
platform-ui.jsx, operator-screens.jsx) as Vue 3 SFCs in
apps/operator/components/:

  Foundation: NodeMark (copied from portal), UiIcon (expanded to 31 icons
  covering sidebar/topbar/sort/arrows)

  Primitives: Card (3 surface variants), UiButton (primary / secondary /
  ghost / dark / danger × sm / md / lg), DataTable (header + rows),
  Badge (7 tones), Avatar (deterministic palette by name hash), Mono,
  Eyebrow, StatusDot, PageHeader (with actions slot)

  Shell: OpSidebar (collapsible 232<->56px, 12 nav items in 4 sections,
  active-row highlight from route, badge slot, brand + user footer);
  OpTopbar (env badge with prod/staging/dev variants, palette trigger
  stub for the ⌘K work in O.8, on-call pill, bell, avatar)

Layouts: layouts/default.vue wires sidebar + topbar + slot; layouts/blank.vue
is used by the login page (definePageMeta layout:'blank'). app.vue now
wraps NuxtPage in NuxtLayout (the missing piece — without it Nuxt warns
"Your project has layouts but the <NuxtLayout /> component has not been
used" and renders nothing chrome-wise).

Composable composables/useSidebar.ts holds the collapsed state shared
between OpSidebar's toggle button and layouts/default.vue's ⌘[ keyboard
shortcut.

Verified in the browser:
  - Sidebar renders all 12 nav links with section dividers, env badge shows
    PROD, PageHeader resolves to the user's display name from
    useOidcAuth().user
  - Collapse toggle flips sidebar width 232↔56; nav rows become icon-only
  - Smoke test on the placeholder home still returns 409 for the seeded
    test-partner (token forwarding survives the layout refactor)

Gotcha documented in the plan: Vite 7.3 added a strict
server.allowedHosts check that returns plaintext 403 for any host header
that isn't the dev origin. The customer portal pre-dates this Vite
version; operator needs allowedHosts: ['operator.dezky.local'] in
nuxt.config.ts under vite.server.

Pages/index.vue replaces the bare HTML placeholder from O.3 with the
new PageHeader + Card primitives — same smoke-test functionality, much
better visual fidelity.

Real screen content (Tenants, Partners, Infrastructure, etc.) lands in
O.5+. This commit is the chrome, the smoke test, and the verification
that the design system primitives compose correctly.

docs/OPERATOR-PLAN.md

@@ -337,17 +337,37 @@ done in order — earlier ones unblock later ones.
       `iss` URL); `AUTHENTIK_ISSUER` env is now comma-separated. The audience
       change in O.2 wasn't enough on its own — issuer matching is separate
 
-### O.4 · Design system + app shell
+### O.4 · Design system + app shell ✓
 
-- [ ] `assets/styles/tokens.css` — copy with `data-theme="dark"` as default
-- [ ] `assets/styles/base.css`
-- [ ] Components: `NodeMark.vue`, `UiIcon.vue` (copy from portal)
-- [ ] Shared primitives ported from the design: `Card`, `Button`, `Table`,
-      `Badge`, `Mono`, `Eyebrow`, `StatusDot`, `Avatar`, `PageHeader`
-- [ ] `OpSidebar.vue` — collapsible, badges per nav item
-- [ ] `OpTopbar.vue` — env badge, ⌘K trigger, on-call pill, bell, avatar
-- [ ] `app.vue` shell wires sidebar + topbar + `<NuxtPage />`
-- [ ] Keyboard shortcut: ⌘[ collapses sidebar, ⌘K opens palette
+- [x] `assets/styles/tokens.css` carbon-default (done in O.3)
+- [x] `assets/styles/base.css` (done in O.3)
+- [x] `NodeMark.vue` (copied unchanged from portal),
+      `UiIcon.vue` (expanded set: 31 icons covering sidebar/topbar/sort/arrows)
+- [x] Shared primitives: `Card`, `UiButton` (5 variants × 3 sizes),
+      `DataTable`, `Badge` (7 tones), `Mono`, `Eyebrow`, `StatusDot`,
+      `Avatar` (deterministic palette), `PageHeader`
+- [x] `OpSidebar.vue` — collapsible (232↔56px), 12 nav items in 4
+      sections, active-row highlight from route, badge slot per item,
+      brand mark + user identity footer
+- [x] `OpTopbar.vue` — env badge (prod/staging/dev), ⌘K palette trigger
+      stub, on-call pill, bell, avatar
+- [x] `layouts/default.vue` wires sidebar + topbar + `<slot />`;
+      `layouts/blank.vue` for the login page; `app.vue` uses `<NuxtLayout>`
+- [x] Keyboard shortcut: ⌘[ collapses/expands sidebar (verified — width
+      flips 232↔56 in the browser via the toggle click). ⌘K palette lands
+      in O.8
+- [x] Verified in browser: shell renders with all 12 nav links, env badge
+      shows PROD, PageHeader title resolves to the user's display name,
+      smoke test re-confirmed 409 on the seeded `test-partner` (token
+      forwarding still works after the layout refactor)
+
+### Gotcha worth noting
+
+- Vite 7.3 added a strict `server.allowedHosts` check that blocks any
+  Host header that isn't an exact match for the dev origin. The customer
+  portal was scaffolded under an older Vite and pre-dates this. Operator
+  needs `allowedHosts: ['operator.dezky.local']` in `nuxt.config.ts`
+  under `vite.server` or every request 403s with a plaintext error.
 
 ### O.5 · Tenant management (real backend)