Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,63 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-10 — Rights you can read, and an Admin Center that means one scope `api 0.137.0` `web 0.167.0`
+
+**Settings meant three different scopes at once** — your own account, the customer selected in the top
+bar, and the whole instance — in one tree of fifteen pages, with the organization picker silently
+applying to only the middle group. That is now three places, each of which means one thing:
+
+- **Admin Center** is an app, beside the RMM and Quick Assist: the licence, the instance's general
+  settings, organizations, users, conversations, statistics and the audit trail.
+- **Each customer's administration is a rail in the RMM**, where the customer picker already applies:
+  general, members, teams, access, agent updates, sessions and screens.
+- **Settings keeps your account**: profile and security.
+
+Every moved address redirects, so a bookmark and a link in an older email still arrive.
+
+**"Who can reach this machine" is now a question with an answer on screen.** The access page reads
+effective access in both directions — from a person, and from a machine or folder — and both say
+**in virtue of which line, held by whom**, rather than leaving you to resolve the organization →
+folder → asset layering in your head. It shows the folder tree annotated at the points where a
+decision is actually made, so the screen stays readable on an estate of hundreds of machines.
+
+It also names the contradictions that used to be discovered by a shell that would not open:
+
+- holds the terminal permission, but no grant that reaches carries `terminal` — opens no shell;
+- a grant carries `terminal`, but the role does not hold the permission — the control is not offered;
+- the same pair for the remote screen;
+- may reveal credentials, but no vault grant that reaches allows it;
+- a grant whose expiry has passed, and which therefore no longer narrows anything;
+- a grant written with no connector domain at all, which is a line somebody mistyped.
+
+**Teams hold grants.** Access stops being written N people × M folders at a time: write it once for a
+team, and membership is what changes. Because adding somebody to a team hands them everything the team
+holds, managing membership is treated as the delegation it is — it is bounded by what you hold
+yourself, exactly like writing a grant.
+
+**A role is no longer just a word in a menu.** What each role may do is printed where roles are handed
+out, with a short description at the point of choice, and the two locks that must both be open — the
+role **and** the grant — are drawn as one composition instead of being learned from a control that
+does nothing.
+
+**Administering one surface no longer means administering all of them.** A platform role is a named
+set of the instance's own surfaces, so somebody can be given the licence page, or the user directory,
+without being given everything. And an organization role can be a named set too, written once on the
+instance and choosable in any organization — a provider writes "Helpdesk N1" once for fifty customers
+instead of fifty times. Nobody can hand out a permission they do not themselves hold.
+
+**An organization can require a second approver.** On the organization's general page: when it is on,
+whoever asked for a plan cannot release it, and the dialog tells the requester who can —
+by name, from the people in that conversation. Rejecting your own plan still works, because the person
+best placed to notice a plan is wrong should not be the one person unable to stop it. **It is off by
+default and nothing changes until somebody turns it on**; with it on, a plan raised in a conversation
+of one waits until the conversation is shared.
+
+Update the API and the web image. No agent update is required. The API applies an additive schema
+update — four new tables (teams, their members, and the two kinds of role definition) and one column on
+an organization for the approval switch. Nothing is dropped and no data is rewritten; existing
+organizations get the switch off, so approvals behave exactly as they did until you change it.
+
 ## 2026-10-09 — The Quick Assist notice opens the operator's card `agent 0.51.0` `api 0.136.0` `web 0.166.0`
 
 On the Jarvis notice at the top of the screen of the person you help with Quick Assist, your name is now
@@ -358,7 +415,7 @@ never presses it.
 
 The operator sees "The person at the machine ended the session from the notice on their screen.",
 and the session history records it under its own reason. The session is not resumed automatically;
-the operator has to open it again, and under *Ask first* the person is asked again.
+the operator has to open it again, and under _Ask first_ the person is asked again.
 
 Update the API, the web console and the agent release image. The API applies an additive schema update
 (a new value for the session's end reason). Update the API no later than the agent: an older API
@@ -403,7 +460,7 @@ works as before: an older agent draws the server's sentence, and an older API se
 When two operators connect to the same Windows session, the person at the machine now sees one notice
 instead of two stacked ones. It names each operator on a line of its own, followed by your
 organization's sentence once. An operator joins the notice when they start watching, after the person
-allowed it under *Ask first*, and their line goes when they disconnect. If the session showing the
+allowed it under _Ask first_, and their line goes when they disconnect. If the session showing the
 notice ends first, the other one shows its own notice straight away and pauses its picture until that
 notice is up. Operators connected to different Windows sessions, such as two users on a Remote Desktop
 Services host, still get one notice each, on their own screen.