feat(door): P2 connections + SSRF-safe executor + native adapter + audit

Migration 035 adds door_connections (per-space controller integration:
secret_ref -> AES-256-GCM secrets vault, never a plaintext password;
pinned_host SSRF pin; native_heatsync|generic_http adapter;
allow_member_self_entry opt-in for phase 3) and door_access_log
(append-only, secrets redacted, service-client-only writes; immutable).
RLS additive/default-deny: connections CRUD = door.manage; log SELECT =
door.manage/operate.

Safety core is pure and heavily unit-tested (door-logic, suite 409):
validateDoorTarget (request host must equal the pinned host;
metadata/link-local always blocked; http(s) only), the
firmware-verified HeatSync encoders with fixed-width zero-padding
(slot 3 / perm 3 / tag 8 / 4-char password), generic template
substitution, and redactDoorSecrets. lib/door/executor.ts is the single
hardened egress: re-validates the pin, refuses redirects, caps time and
body, redacts before any audit write. The door password is read from the
secrets vault and decrypted server-side only, never returned or logged.
/door/manage (door.manage) configures connections, picks a vault secret,
and runs a safe status-only test. Sidebar Admin link added; "Learn"
moved before "People" per request. Docs updated.

docs/API_REFERENCE.md

@@ -928,3 +928,7 @@ Registry management is gated by `equipment.manage`; reserving needs only members
 - `reserveEquipment(input)` / `cancelReservation(input)` — any member. Validated service-client writes (`equipment_reservations` has no INSERT/DELETE policy): `reserveEquipment` runs `reservationEligibility` (status/active, future window, `hasConflict` no-overlap, required-cert) — a holder of `equipment.manage` gets the override and may pass `memberId` to book on someone's behalf; `cancelReservation` allows the owner or an `equipment.manage` holder.
 - `listEquipmentReservations(input)` — `equipment.manage`; reservations for one item (joined member) for the schedule view.
 - `getMyReservations()` — the signed-in member's own reservations (joined equipment). No params; RLS restricts to own rows (the `/me` view).
+
+### Door epic: `member-cards.ts` (migration 034) + `door.ts` (migration 035)
+Card UID is a credential. `member-cards.ts`: `addMemberCard`/`updateMemberCard`/`deleteMemberCard`/`listMemberCards` are `door.manage` (full UID); `getMyCards()` is the member's own MASKED view (service client, returns only count + last4, never the raw UID — `member_cards` has no member RLS SELECT).
+`door.ts` (all `door.manage` except the read log): `createDoorConnection`/`updateDoorConnection`/`deleteDoorConnection`/`listDoorConnections`; `listSecretTitles()` (titles only, to pick a vault secret for the password). `testDoorConnection(input)` runs only the `status` verb through the hardened executor and writes one redacted audit row. `listDoorAccessLog()` is `door.manage` OR `door.operate`. Security model: the shared password is read from the AES-256-GCM secrets vault server-side and embedded in the request per the verified firmware (auth is a query param); `lib/door/executor.ts` is the single egress — it enforces `validateDoorTarget` (request host must equal the connection's pinned host; metadata/link-local always blocked; http(s) only), refuses redirects, caps time/body, and `redactDoorSecrets` scrubs the password before anything is logged. Native HeatSync verbs are encoded with the verified fixed-width zero-padding (slot 3 / perm 3 / tag 8 / `&e=` password); generic connections use admin `{slot}/{tag}/{pw}` templates. Live grant/revoke/open and the per-connection member self-entry are phase 3.

docs/ARCHITECTURE.md

@@ -421,7 +421,8 @@ customizable permissions + Ops ACLs, self-change hardening, `026`-`029` custom
 forms + waivers + onboarding form step + per-space form slug + invite roles,
 `030` certifications + Instructor capability, `031` secrets SELECT honors
 `ops.secrets.read`, `032` classes + sessions + signups, `033` equipment +
-reservations).
+reservations, `034` member access cards + door permissions, `035` door
+connections + access log).
 
 ### Forms & waivers (migrations 026-029; complete Phases 1-5)
 
@@ -510,6 +511,28 @@ rule, and the required-certification gate (checked against the normal
 `member_certifications` data; an `equipment.manage` holder gets the
 override and may book on a member's behalf). No anonymous path.
 
+### Door / access control (migrations 034-035; epic in progress)
+
+Phased; P1-P2 built. `member_cards` (034) associates RFID/NFC UIDs to
+members; the UID is a credential (`door.manage`-only RLS, no member SELECT;
+masked count+last4 self-view via a service-client action). `door.manage` /
+`door.operate` permissions (group Access). `door_connections` (035) is a
+per-space controller integration: the shared password is NOT stored on the
+row — `secret_ref` points at the existing AES-256-GCM `secrets` vault and is
+decrypted server-side only. `pinned_host` is the SSRF pin. Pure logic in
+`lib/door-logic.ts` (SSRF `validateDoorTarget`, always-blocked metadata/
+link-local, native HeatSync encoders with the firmware-verified fixed-width
+zero-padding, generic template substitution, secret redaction) is heavily
+unit-tested. `lib/door/executor.ts` is the single hardened egress: it
+re-validates the target against the pin, refuses redirects, caps time and
+body, and redacts secrets before any audit write. `door_access_log` is an
+append-only, secrets-redacted audit with no client write policy (validated
+service-client executor only). `/door/manage` (door.manage) configures
+connections, picks a vault secret, and runs a safe `status`-only test.
+Phase 3 adds live grant/revoke/open and the per-connection member
+self-entry (opt-in, elevated risk, off by default); phases 4-5 add inbound
+log ingest and the universal API-call UI builder. No anonymous path.
+
 ---
 
 ## 13. Known Limitations

docs/DATABASE_SCHEMA.md

@@ -686,7 +686,7 @@ CREATE INDEX idx_activity_space ON activity_log(space_id, created_at);
 
 ---
 
-## Migrations 014-034 (additions since the 13-table baseline)
+## Migrations 014-035 (additions since the 13-table baseline)
 
 `scripts/schema.sql` is the canonical idempotent schema; each numbered
 migration is mirrored as a section in it. Tables/columns added:
@@ -714,6 +714,7 @@ migration is mirrored as a section in it. Tables/columns added:
 | 032 | `classes`, `class_sessions`, `class_signups` (class offerings, scheduled sessions, member signups; optional `payment_link` and `grants_certification_id`; partial unique = one non-cancelled signup per member+session). RLS additive + default-deny: classes SELECT = `classes.manage` (all) or member (`is_active`), class_sessions SELECT = any space member, class_signups SELECT = manage/instruct (all) or member (own), UPDATE = `classes.instruct`, NO INSERT/DELETE policy (signup/cancel via a validated service-client action enforcing capacity/waitlist/dedupe). New `classes.manage` + `classes.instruct` permissions seeded to board + backfilled. Cert-on-completion uses the normal certifications path (still needs `certifications.grant`). No anonymous path |
 | 033 | `equipment` (registry; status available/maintenance/retired; optional `required_certification_id`; `is_active` archive) + `equipment_reservations` (member time-window reservation; denormalized space_id; no DB overlap constraint). RLS additive + default-deny: equipment SELECT = `equipment.manage` (all) or member (`is_active`), reservations SELECT = `equipment.manage` (all) or member (own), UPDATE = `equipment.manage`, NO INSERT/DELETE policy (reserve/cancel via validated service-client action enforcing status + no-overlap + required-cert, manager override). New `equipment.manage` permission seeded to board + backfilled. No anonymous path |
 | 034 | `member_cards` (RFID/NFC card UID -> member; the UID is a credential -- `door.manage`-only RLS, no member SELECT policy; masked self-view via a server action). New `door.manage` + `door.operate` permissions (group Access; the whole Door epic uses them) seeded to board + backfilled. No controller calls in this phase, no anonymous path |
+| 035 | `door_connections` (per-space controller integration; shared password NOT stored -- `secret_ref` -> AES-256-GCM `secrets` vault, decrypted server-side only; `pinned_host` SSRF pin; adapter native_heatsync|generic_http; `allow_member_self_entry` opt-in) + `door_access_log` (append-only, secrets redacted). RLS additive + default-deny: door_connections CRUD = `door.manage`; door_access_log SELECT = `door.manage`/`door.operate`, NO write policy (service-client executor only; immutable). No new permission codes (door.* from 034). No anonymous path |
 
 New enum: `comment_entity_type` = `forum_thread | proposal | incident | policy`.