docs(teams): Business lock policy (#510)

docs/reference/pricing.md

@@ -26,6 +26,7 @@ Current pricing is at **[voltius.app/#pricing](https://voltius.app/#pricing)** 
 | Team vaults | | | ✓ | ✓ |
 | Audit logs | Local | Local | Team audit logs | Team audit logs |
 | Roles & permissions | | | Built-in roles | Custom roles, per-member & per-object permissions |
+| Lock policy (maximum auto-lock, require Lock vault) | | | | ✓ |
 | Self-hosting commercial license | | | | ✓ |
 | Priority support | | | | ✓ |
 

docs/self-hosting/quickstart.md

@@ -71,4 +71,4 @@ docker compose pull
 docker compose up -d
 ```
 
-Update the server whenever you update the app. An older server can make the app turn features off — for example, it locks your team's custom roles and permissions.
+Update the server whenever you update the app. An older server can make the app turn features off — for example, it locks your team's custom roles and permissions, and lock policies can't be set.

docs/sync/master-password.md

@@ -9,7 +9,7 @@ icon: lucide/key-square
 With a master password, a locked vault stays encrypted until you enter your passphrase. There's no recovery — the key is derived from your password.
 ///
 
-Lock your vault with a passphrase. Voltius keeps it in the OS keychain until you lock the vault (**Lock vault**, or **Auto-lock vault after inactivity** in Settings → Account); after that it must be entered to unlock, including at launch.
+Lock your vault with a passphrase. Voltius keeps it in the OS keychain until you lock the vault (**Lock now**, or **Auto-lock after inactivity** with **Lock vault** chosen in Settings → Account → Session security); after that it must be entered to unlock, including at launch.
 
 ## Setup
 

docs/teams/index.md

@@ -8,7 +8,7 @@ Multi-user workflows on Teams and Business plans. End-to-end encryption is the s
 
 - **[Team vaults](team-vaults.md)** — shared encrypted stores
 - **[Roles & permissions](roles.md)** — built-in roles; custom roles, per-member & per-object permissions (Business)
-- **[Members](members.md)** — invite, remove, role assignment
+- **[Members](members.md)** — invite, remove, role assignment; lock policy (Business)
 - **[Audit logs](audit-logs.md)** — who did what, when
 - **[Terminal sharing](terminal-sharing.md)** — multiplayer with guests
 - **[Billing](billing.md)** — subscription, seats, invoices

docs/teams/members.md

@@ -53,3 +53,27 @@ Seat usage shows in the **Invite** panel (e.g. `3 used · 2 available · 5 total
 
 !!! tip
     Invites stay open for 7 days. An expired one can be sent again from the Members list.
+
+## Lock policy
+
+!!! info "Business"
+    Lock policies need the team's Business plan. A self-hosted server counts as Business.
+
+A lock policy makes every member's app lock on a schedule you choose. Open **Members → Security**, or **Security policy…** in the vault menu, and turn on **Enforce auto-lock**:
+
+- **Lock after at most** — members can pick this time or a shorter one in **Settings → Account → Session security**, never a longer one or **Never**. **Immediately** locks as soon as they leave Voltius.
+- **Require Lock vault** — locking always removes the vault key from memory and closes open sessions. **Lock screen** is unavailable.
+
+Changes apply within seconds on every member's devices. You need the permission to manage the vault (the same one that lets you rename it).
+
+What members see:
+
+- Their Session security settings show the policy's values, with a line saying which team set them.
+- Their own choices are kept. Removing the policy, or leaving the team, brings them back.
+- In several teams with policies, the strictest one applies: the shortest time, and **Lock vault** if any team requires it.
+- The policy keeps applying offline, from the last one the app received.
+
+The policy applies to everyone in the team, owners and admins included. Voltius versions older than the one that introduced lock policies ignore it.
+
+If the team's Business plan lapses, an existing policy stays in force and can only be removed.
+