feat(lobby): F8-04b hierarchical sidebar + paid-tier gate for create-game

Reshape the lobby UI from a single Overview into a two-level sidebar
(games · profile · DEV synthetic-reports) with four games sub-panels
(active-past · recruitment · invitations · private-games). Move the
`create new game` button into the private-games panel, merge the
applications section into recruitment cards as status chips, and add
DEV-only synthetic-report loader as a top-level screen.

Add a paid-tier gate at backend `lobby.game.create`: free callers get
`403 forbidden` before the lobby service is invoked. The UI hides the
private-games sub-panel + create button on free tier (DEV affordances
flag overrides). Update every integration test that creates a game to
use a new `testenv.PromoteToPaid` helper; add a new
`TestLobbyFlow_FreeUserCreateGameForbidden`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

integration/admin_global_games_view_test.go

@@ -48,6 +48,7 @@ func TestAdminGlobalGamesView(t *testing.T) {
 
 	// Two users; user A creates a private game.
 	a := testenv.RegisterSession(t, plat, "ownerA@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, a)
 	b := testenv.RegisterSession(t, plat, "ownerB@example.com")
 	aID, err := a.LookupUserID(ctx, plat)
 	if err != nil {

integration/engine_command_proxy_test.go

@@ -29,6 +29,7 @@ func TestEngineCommandProxy(t *testing.T) {
 	}
 
 	owner := testenv.RegisterSession(t, plat, "owner+cmd@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
 	ownerID, err := owner.LookupUserID(ctx, plat)
 	if err != nil {
 		t.Fatalf("resolve owner: %v", err)

integration/lobby_flow_test.go

@@ -38,6 +38,7 @@ func TestLobbyFlow_PrivateGameInviteRedeem(t *testing.T) {
 	}
 
 	owner := testenv.RegisterSession(t, plat, "owner+lobby@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
 	invitee := testenv.RegisterSession(t, plat, "invitee+lobby@example.com")
 	ownerID, err := owner.LookupUserID(ctx, plat)
 	if err != nil {

integration/lobby_free_tier_test.go

@@ -0,0 +1,61 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+	"time"
+
+	"galaxy/integration/testenv"
+)
+
+// TestLobbyFlow_FreeUserCreateGameForbidden asserts the F8-04b backend
+// tier gate: a freshly registered (free-tier) account is rejected with
+// `403 forbidden` when it tries to create a private game through the
+// user-facing surface. The matching paid sibling
+// `TestLobbyFlow_PrivateGameInviteRedeem` covers the success path with
+// `testenv.PromoteToPaid`.
+func TestLobbyFlow_FreeUserCreateGameForbidden(t *testing.T) {
+	plat := testenv.Bootstrap(t, testenv.BootstrapOptions{})
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	owner := testenv.RegisterSession(t, plat, "owner+free@example.com")
+	ownerID, err := owner.LookupUserID(ctx, plat)
+	if err != nil {
+		t.Fatalf("resolve owner: %v", err)
+	}
+	ownerHTTP := testenv.NewBackendUserClient(plat.Backend.HTTPURL, ownerID)
+
+	gameBody := map[string]any{
+		"game_name":             "Free Tier Game",
+		"visibility":            "private",
+		"min_players":           2,
+		"max_players":           4,
+		"start_gap_hours":       1,
+		"start_gap_players":     2,
+		"enrollment_ends_at":    time.Now().Add(24 * time.Hour).UTC().Format(time.RFC3339),
+		"turn_schedule":         "0 * * * *",
+		"target_engine_version": "v1.0.0",
+	}
+	raw, resp, err := ownerHTTP.Do(ctx, http.MethodPost, "/api/v1/user/lobby/games", gameBody)
+	if err != nil {
+		t.Fatalf("create private game: %v", err)
+	}
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("expected 403 forbidden, got status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	var envelope struct {
+		Error struct {
+			Code    string `json:"code"`
+			Message string `json:"message"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(raw, &envelope); err != nil {
+		t.Fatalf("decode error envelope: %v body=%s", err, string(raw))
+	}
+	if envelope.Error.Code != "forbidden" {
+		t.Fatalf("expected code=forbidden, got %q body=%s", envelope.Error.Code, string(raw))
+	}
+}

integration/lobby_my_games_test.go

@@ -31,6 +31,7 @@ func TestLobbyMyGamesList(t *testing.T) {
 	}
 
 	owner := testenv.RegisterSession(t, plat, "owner+mygames@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
 	pilot := testenv.RegisterSession(t, plat, "pilot+mygames@example.com")
 	ownerID, err := owner.LookupUserID(ctx, plat)
 	if err != nil {

integration/lobby_open_enrollment_test.go

@@ -29,6 +29,7 @@ func TestLobbyOpenEnrollment(t *testing.T) {
 	}
 
 	owner := testenv.RegisterSession(t, plat, "owner+enroll@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
 	other := testenv.RegisterSession(t, plat, "other+enroll@example.com")
 	ownerID, err := owner.LookupUserID(ctx, plat)
 	if err != nil {

integration/notification_flow_test.go

@@ -28,6 +28,7 @@ func TestNotificationFlow_LobbyInvite(t *testing.T) {
 	}
 
 	inviter := testenv.RegisterSession(t, plat, "inviter@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, inviter)
 	invitee := testenv.RegisterSession(t, plat, "invitee@example.com")
 	inviterUser, err := inviter.LookupUserID(ctx, plat)
 	if err != nil {

integration/runtime_lifecycle_test.go

@@ -31,6 +31,7 @@ func TestRuntimeLifecycle(t *testing.T) {
 	}
 
 	owner := testenv.RegisterSession(t, plat, "owner+runtime@example.com")
+	testenv.PromoteToPaid(t, ctx, admin, plat, owner)
 	ownerID, err := owner.LookupUserID(ctx, plat)
 	if err != nil {
 		t.Fatalf("resolve owner: %v", err)

integration/testenv/session.go

@@ -92,6 +92,35 @@ func (s *Session) DialAuthenticated(ctx context.Context, plat *Platform) (*Signe
 	return DialGateway(ctx, plat.Gateway.GRPCAddr, s.DeviceSessionID, s.Private, plat.Gateway.ResponseSignerPublic)
 }
 
+// PromoteToPaid applies a permanent paid entitlement to the user
+// behind sess via the backend admin surface, so subsequent lobby
+// commands gated by `EntitlementProvider.IsPaid` (notably
+// `POST /api/v1/user/lobby/games`) succeed. Helper for integration
+// scenarios that create games end-to-end; the default
+// `RegisterSession` leaves the user on the free tier.
+func PromoteToPaid(t *testing.T, ctx context.Context, admin *BackendAdminClient, plat *Platform, sess *Session) {
+	t.Helper()
+	if sess == nil {
+		t.Fatalf("PromoteToPaid: nil session")
+	}
+	userID, err := sess.LookupUserID(ctx, plat)
+	if err != nil {
+		t.Fatalf("PromoteToPaid: lookup user_id: %v", err)
+	}
+	body := map[string]any{
+		"tier":   "permanent",
+		"source": "integration_test",
+		"actor":  map[string]any{"type": "admin", "id": "integration"},
+	}
+	raw, resp, err := admin.Do(ctx, http.MethodPost, "/api/v1/admin/users/"+userID+"/entitlements", body)
+	if err != nil {
+		t.Fatalf("PromoteToPaid: %v", err)
+	}
+	if resp.StatusCode/100 != 2 {
+		t.Fatalf("PromoteToPaid: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+}
+
 // LookupUserID resolves the user_id for s via backend's internal
 // session lookup. Returns an empty string if the session is unknown.
 func (s *Session) LookupUserID(ctx context.Context, plat *Platform) (string, error) {