feat(door): member self-entry on the dashboard (locked design)

selfEntry({connectionId}): any active member with >=1 active card on file
may trigger a momentary open on a connection that is enabled and has
allow_member_self_entry on (locked rule: any active card, no slot row
required). Membership/cards resolved server-side so a member can only open
for themselves; never unlock/lock/grant/revoke; never anonymous. Strict
5/min per-member rate limit, one redacted self_entry audit row (denials
audited too), through the existing hardened executor. listSelfEntryDoors
returns the enabled self-entry connections only when the caller has an
active card, so the dashboard 'Door access' panel is hidden for
ineligible members. API_REFERENCE + ARCHITECTURE + HANDOFF pass-28.

app/(app)/dashboard/door-self-entry.tsx

@@ -0,0 +1,42 @@
+'use client'
+
+import { useState } from 'react'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import { useConfirm } from '@/components/ui/confirm'
+import { selfEntry } from '@/lib/actions'
+
+type Door = { id: string; name: string }
+
+export function DoorSelfEntry({ doors }: { doors: Door[] }) {
+  const confirm = useConfirm()
+  const [busy, setBusy] = useState<string | null>(null)
+
+  async function open(d: Door) {
+    const ok = await confirm({
+      title: `Open ${d.name}?`,
+      description:
+        'This sends a live command that physically opens the door. Only do this if you are at the door and authorized to enter.',
+      confirmText: 'Open the door',
+    })
+    if (!ok) return
+    setBusy(d.id)
+    const res = await selfEntry({ connectionId: d.id })
+    setBusy(null)
+    if ('error' in res && res.error) return toast.error(res.error)
+    toast.success(`${d.name} opened`)
+  }
+
+  return (
+    <div className="bg-card rounded border border-border divide-y divide-border">
+      {doors.map(d => (
+        <div key={d.id} className="flex items-center justify-between gap-3 px-4 py-3">
+          <span className="font-sans text-sm text-foreground truncate">{d.name}</span>
+          <Button size="sm" disabled={busy === d.id} onClick={() => open(d)}>
+            {busy === d.id ? 'Opening…' : 'Open'}
+          </Button>
+        </div>
+      ))}
+    </div>
+  )
+}

app/(app)/dashboard/page.tsx

@@ -4,6 +4,8 @@ import { redirect } from 'next/navigation'
 import type { Tables } from '@/types/database'
 import { PageTitle } from '@/components/ui/page-title'
 import { Empty, EmptyHeader, EmptyMedia, EmptyTitle, EmptyDescription } from '@/components/ui/empty'
+import { listSelfEntryDoors } from '@/lib/actions'
+import { DoorSelfEntry } from './door-self-entry'
 
 function IcoUsers({ className }: { className?: string }) {
   return <svg className={className} fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M17 20h5v-2a3 3 0 00-5.356-1.857M17 20H7m10 0v-2c0-.656-.126-1.283-.356-1.857M7 20H2v-2a3 3 0 015.356-1.857M7 20v-2c0-.656.126-1.283.356-1.857m0 0a5.002 5.002 0 019.288 0M15 7a3 3 0 11-6 0 3 3 0 016 0zm6 3a2 2 0 11-4 0 2 2 0 014 0zM7 10a2 2 0 11-4 0 2 2 0 014 0z" /></svg>
@@ -20,6 +22,9 @@ function IcoPay({ className }: { className?: string }) {
 function IcoPlus({ className }: { className?: string }) {
   return <svg className={className} fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 4v16m8-8H4" /></svg>
 }
+function IcoDoor({ className }: { className?: string }) {
+  return <svg className={className} fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M3 21h18M6 21V5a2 2 0 012-2h8a2 2 0 012 2v16M14 12h.01" /></svg>
+}
 
 export default async function DashboardPage() {
   const supabase = await createClient()
@@ -153,6 +158,9 @@ export default async function DashboardPage() {
     )
   }
 
+  const selfEntryRes = await listSelfEntryDoors()
+  const selfEntryDoors = ('data' in selfEntryRes ? selfEntryRes.data : []) as { id: string; name: string }[]
+
   return (
     <div className="min-h-screen bg-background">
       <div className="bg-sidebar px-4 md:px-6 py-3 flex items-center justify-between">
@@ -321,6 +329,15 @@ export default async function DashboardPage() {
           </div>
 
           <div className="space-y-6">
+            {selfEntryDoors.length > 0 && (
+              <div>
+                <p className="font-mono text-[10px] tracking-widest text-muted-foreground uppercase mb-3 flex items-center gap-1.5">
+                  <IcoDoor className="w-3 h-3" /> Door access
+                </p>
+                <DoorSelfEntry doors={selfEntryDoors} />
+              </div>
+            )}
+
             <div>
               <div className="flex items-center justify-between mb-3">
                 <p className="font-mono text-[10px] tracking-widest text-muted-foreground uppercase">Payment Alerts</p>