[kipavy]

Follow-ups from the spec-3 review of the org lock policy (#581). Part of #510.

Changes

• Sign-out drops the policy. resetVault() clears the in-memory team lock policy before wiping the persisted copy. Mobile logout does not reload, so it used to keep enforcing the previous account's policy until restart. Not done in onSessionEnd: that also runs on Lock vault, and clearing there would drop enforcement after an offline unlock.
• Security panel on an unmanaged team. Switching the Members vault tab to a team you can't manage now hides the Security panel instead of showing controls that return 403. It is hidden rather than closed because the vault-menu deep link opens it before that team's members (and so your permissions) have loaded.
• Audit log. team.lock_policy_set / team.lock_policy_removed render as "set the lock policy (auto-lock: 15 minutes)", "… Lock vault required", "removed the lock policy", and the action filter offers both. The 34 hand-written filter entries become one action list whose labels come from the same key helper actionName uses.
• Admin warning. The Security panel warns when Immediately is combined with Require Lock vault.
• Named capability. The vault menu's Security policy item is gated on canSetLockPolicy instead of canRename (same rule: owner or Manage vault).
• Plan card. The in-app plan comparison lists the team lock policy as Business-only.

New strings are in all six locales. The non-English ones are mine, not a native speaker's.

Verification

• vitest: src/components/members, src/components/vault-admin, src/components/logs, src/i18n, src/services/vault.test.ts, AccountSection tests. tsc --noEmit is clean.
• Live in the headless app against an isolated server (voltius-server:sha-ff7968c, self-host mode, so Business): set and removed policies, and checked the audit rows, the action filter (filtering on "Lock policy removed" returns only that row), the warning and the plan card. Before/after screenshots on desktop and in the mobile shell were approved before commit.
• Not covered live: the hidden panel on an unmanaged team, which needs a second account. It is covered by MembersPage.PendingPanel.test.tsx.

Cons

• Switching back to a managed team reopens a Security panel that was hidden by the switch, instead of leaving it closed.