feat(isac): grant agents baseline data contribution access

src/routes/admin/audit/+page.server.ts

@@ -70,6 +70,7 @@ export const load: PageServerLoad = async ({ cookies, url }) => {
 		(await database.prepare('SELECT action,COUNT(*) AS count FROM audit_log GROUP BY action ORDER BY action')).all(),
 		(await database.prepare(`SELECT COUNT(*) AS total,
 			SUM(CASE WHEN entity_type='game_data' THEN 1 ELSE 0 END) AS game_data,
+			SUM(CASE WHEN entity_type='data_moderation' THEN 1 ELSE 0 END) AS data_moderation,
 			SUM(CASE WHEN entity_type IN ('user','user_access','user_moderation','identity') THEN 1 ELSE 0 END) AS users,
 			SUM(CASE WHEN entity_type IN ('role','role_management') THEN 1 ELSE 0 END) AS access
 			FROM audit_log`)).get()

src/routes/admin/audit/+page.svelte

@@ -20,9 +20,10 @@
 
 <svelte:head><title>Audit history — ISAC</title></svelte:head>
 <div class="module-toolbar audit-toolbar"><div><p class="eyebrow">SYSTEM OVERSIGHT</p><h2>AUDIT HISTORY</h2><p>Immutable operator activity, target records, and before/after change evidence.</p></div></div>
-<KpiFilters parameter="category" active={data.filters.category} items={[
+<KpiFilters className="audit-kpis" parameter="category" active={data.filters.category} items={[
 	{value:'',label:'ALL EVENTS',count:data.summary.total,description:'Complete audit history'},
 	{value:'game_data',label:'GAME DATA',count:data.summary.game_data,description:'Builder-source mutations'},
+	{value:'data_moderation',label:'DATA MODERATION',count:data.summary.data_moderation,description:'Proposal lifecycle decisions'},
 	{value:'user',label:'USER OPERATIONS',count:data.summary.users,description:'Access, moderation, identities'},
 	{value:'access_policy',label:'ACCESS POLICY',count:data.summary.access,description:'Role definition changes'}
 ]}/>

src/routes/admin/roles/+page.svelte

@@ -17,6 +17,7 @@
 
 <svelte:head><title>Roles & permissions — ISAC</title></svelte:head>
 <div class="module-toolbar"><div><p class="eyebrow">ACCESS POLICY REGISTRY</p><h2>ROLES & PERMISSIONS</h2><p>Compose reusable access roles from discrete SHD.build capabilities.</p></div><button class="primary" onclick={() => editing = blank()}>ADD ROLE <span>＋</span></button></div>
+<p class="access-baseline-note"><b>REGISTERED AGENT BASELINE</b><span>Every active account inherently receives isac.access, data.view, and data.propose. Roles add elevated capabilities and cannot remove this baseline.</span></p>
 <KpiFilters className="role-kpis" active={data.filter} items={[
 	{value:'',label:'TOTAL ROLES',count:data.summary.total,description:'Show all role definitions'},
 	{value:'isac',label:'ISAC ACCESS',count:data.summary.isac,description:'Can open the console'},

src/routes/admin/users/[id]/+page.svelte

@@ -40,6 +40,7 @@
 			<PendingForm action="?/setAccess">
 				<div class="selection-head"><div><span>ASSIGNED ROLES</span><small>PERMISSION BUNDLES</small></div><b>{roleIds.length} SELECTED</b></div>
 				<div class="selection-grid">{#each data.roles as role}<label><input type="checkbox" name="roleIds" value={role.id} bind:group={roleIds}/><span>{role.name}</span><small>{roleIds.includes(role.id) ? 'ASSIGNED' : 'AVAILABLE'}</small></label>{/each}</div>
+				<p class="access-baseline-note compact"><b>REGISTERED AGENT BASELINE</b><span>isac.access · data.view · data.propose are inherent and are not removable here.</span></p>
 				<div class="selection-head"><div><span>DIRECT PERMISSIONS</span><small>USER-SPECIFIC CAPABILITIES</small></div><b>{permissionIds.length} SELECTED</b></div>
 				<div class="selection-grid permission-grid">{#each data.permissions as permission}<label title={permission.description}><input type="checkbox" name="permissionIds" value={permission.id} bind:group={permissionIds}/><span>{permission.name}</span><small>{permissionIds.includes(permission.id) ? 'GRANTED' : 'AVAILABLE'}</small></label>{/each}</div>
 				{#if form?.accessError}<p class="error">{form.accessError}</p>{/if}{#if form?.accessSaved}<p class="success">Roles and direct permissions updated.</p>{/if}<div class="form-actions"><button type="button" class="primary" onclick={() => accessConfirmationOpen = true}>REVIEW ACCESS →</button></div>