feat(lobby): F8-04b hierarchical sidebar + paid-tier gate for create-game

Reshape the lobby UI from a single Overview into a two-level sidebar
(games · profile · DEV synthetic-reports) with four games sub-panels
(active-past · recruitment · invitations · private-games). Move the
`create new game` button into the private-games panel, merge the
applications section into recruitment cards as status chips, and add
DEV-only synthetic-report loader as a top-level screen.

Add a paid-tier gate at backend `lobby.game.create`: free callers get
`403 forbidden` before the lobby service is invoked. The UI hides the
private-games sub-panel + create button on free tier (DEV affordances
flag overrides). Update every integration test that creates a game to
use a new `testenv.PromoteToPaid` helper; add a new
`TestLobbyFlow_FreeUserCreateGameForbidden`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

integration/testenv/session.go

@@ -92,6 +92,35 @@ func (s *Session) DialAuthenticated(ctx context.Context, plat *Platform) (*Signe
 	return DialGateway(ctx, plat.Gateway.GRPCAddr, s.DeviceSessionID, s.Private, plat.Gateway.ResponseSignerPublic)
 }
 
+// PromoteToPaid applies a permanent paid entitlement to the user
+// behind sess via the backend admin surface, so subsequent lobby
+// commands gated by `EntitlementProvider.IsPaid` (notably
+// `POST /api/v1/user/lobby/games`) succeed. Helper for integration
+// scenarios that create games end-to-end; the default
+// `RegisterSession` leaves the user on the free tier.
+func PromoteToPaid(t *testing.T, ctx context.Context, admin *BackendAdminClient, plat *Platform, sess *Session) {
+	t.Helper()
+	if sess == nil {
+		t.Fatalf("PromoteToPaid: nil session")
+	}
+	userID, err := sess.LookupUserID(ctx, plat)
+	if err != nil {
+		t.Fatalf("PromoteToPaid: lookup user_id: %v", err)
+	}
+	body := map[string]any{
+		"tier":   "permanent",
+		"source": "integration_test",
+		"actor":  map[string]any{"type": "admin", "id": "integration"},
+	}
+	raw, resp, err := admin.Do(ctx, http.MethodPost, "/api/v1/admin/users/"+userID+"/entitlements", body)
+	if err != nil {
+		t.Fatalf("PromoteToPaid: %v", err)
+	}
+	if resp.StatusCode/100 != 2 {
+		t.Fatalf("PromoteToPaid: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+}
+
 // LookupUserID resolves the user_id for s via backend's internal
 // session lookup. Returns an empty string if the session is unknown.
 func (s *Session) LookupUserID(ctx context.Context, plat *Platform) (string, error) {