pdombkins turns Rose into the K&S matter workspace

ks.matter_projects maps matter -> project, many-to-many because NexaCare is
worked by all six groups and already has six per-group Rose projects holding
real student work. Triggers on ks.matters (insert/rename/delete) and
ks.matter_groups keep projects and project_group_grants aligned.

Access needs nothing new: project_group_grants already gives a user_group
'editor' on a project and groupAccess.ts resolves it by email, so a student
reaches exactly the projects for the matters they are on.

group_id pins a project to its group. The first version of the grant query
cross-joined every mapped project with every group on the matter, which gave
all six groups access to each other's NexaCare workspace - caught in
verification and fixed before it reached anyone.

Deleting a matter deletes only auto_created projects; the six pre-existing
NexaCare projects are mapped auto_created=false so no trigger can discard the
cohort's chats and tabular reviews.

Verified live: create -> project + one correct grant; rename -> project
renamed; delete -> project and grants gone, no residue.

A lawyer working a matter reaches for their AI tools without leaving it, so
Rose now opens in a side panel on the K&S matter page - tabbed Assistant /
Documents / Workflows, scoped to that matter's Rose project via
ks.matter_projects.

Both apps are same-origin (K&S at /firm), so the iframe shares the Supabase
session: no second login and no token in the URL. The frame is a normal Rose
page load, so Rose applies its usual project access checks. Rose hides its own
sidebar when framed, detected from window.self !== window.top so it survives
navigation inside the panel.

Also fixes three defects in ks.matter_projects, which shipped yesterday with
no RLS and no grant because only triggers had ever written it: RLS enabled,
SELECT granted to authenticated, and the read policy now respects the group
pin - without that, five students out of six would have had the panel resolve
NexaCare to another group's project.

The side panel put Rose inside K&S, which meant 3 of Rose's 12 features in a
680px drawer. Deleted. The nesting is now the other way round.

/firm is a Route Handler serving the K&S SPA outside the (pages) layout, so
crossing into K&S left Rose's React tree and took AppSidebar with it. The new
page at (pages)/workspace/[[...slug]] frames /firm from inside that layout, so
Rose's full sidebar stays put while a lawyer works a matter and every feature
is one client-side push away.

A wrapper path rather than nesting /firm itself, because the K&S bundle is
built with basename=/firm and a page there would shadow the URL the frame
loads. RouteBridge posts the K&S route up so the host URL follows the frame
(refresh and deep links work), and redirects unframed /firm hits into the
shell. K&S's marketing header is suppressed when framed.

13 write tools: tasks, assignments, time, calendar, matter fields and matter
documents. All in WRITE_TOOLS, so any agent plan containing one stops at the
approval gate; drafting gets the full set, intake gets create-only, and
research/review/verify stay read-only.

The backend runs as service-role so RLS does not apply - every path enforces
scope itself. The shared teaching matter is append-only: anyone may add to
NexaCare, only the creator may change or delete, and the guard fails closed
because all 49 seeded tasks have performed_by null. That keeps the Week-9
evidence base reproducible for all six groups. ks_update_matter refuses the
shared matter outright, since matter-level fields are not row-owned.

Fixes a break found in verification: created_by/uploaded_by/assigned_to and
the various user_id columns reference ks.profiles (the personas), not
auth.users. The first version stamped the student's auth id into created_by,
which would have failed the foreign key on every task create.

Verified live: append allowed, seeded row blocked, own row allowed, and a
3h @ $600 entry moved matter fees 151,615 -> 153,415 and back with no
residue, confirming the recompute triggers fire from these writes.