Add Buckets, Monitoring, Memberships, Networking, SSO, Announcements, Status page

Full set of admin surfaces on top of /platform/* and /admin/* endpoints,
plus a migration of /assistant onto @crema/llm-providers-ui.

Buckets (/buckets):
  S3-level CRUD over /platform/buckets — list, create, delete (with the
  6-digit confirmation flow the backend enforces), per-bucket configure
  for versioning / CORS rules / policy JSON, plus an object browser
  with FileGrid/FileList from @crema/file-ui and presigned-URL reveal.
  Storage-config picker scopes the view to one credential at a time.

Monitoring (/monitoring):
  Live dashboard. Service health board derived from indirect signals
  (status-ui OverallStatus + ComponentRow). KPI tiles for sessions,
  jobs, audit. Tabs: background jobs (Donut + BarChart + retry recent),
  sessions (Sparkline of last 24h sign-ins), audit activity (BarChart
  of severity / top resource types), infrastructure (DO summary +
  WorldMapSvg coloured by droplet region + droplet list + Spaces),
  rate limits. 30s auto-refresh.

Memberships (/memberships):
  M:N glue between users and tenants over /admin/memberships. Add /
  edit / suspend / activate / remove with role multi-select.

Networking (/networking):
  Tabs over /platform/{firewalls,vpcs,domains,floating_ips}.
  Read/delete on firewalls, read on VPCs, full DNS-record CRUD, and
  inline assign/unassign for floating IPs.

SSO (/sso):
  /sso/identity-providers CRUD with PEM cert as write-only field, plus
  /sso/sessions list with destroy.

Announcements (/announcements):
  /admin/announcements CRUD. Platform-wide vs per-tenant audience,
  schedule windows, dismissible + active toggles.

Status page (/status-page):
  /admin/status-page/{components,incidents,subscribers}. Components
  CRUD, incidents with timeline + post-update + resolve flow,
  subscriber list. Public preview at the top using StatusBoard +
  IncidentTimeline from @crema/status-ui.

Assistant migration:
  /assistant now uses @crema/llm-providers-ui (provider catalog +
  vault key resolution) instead of ~/lib/llm-settings. Same async
  buildAdapter() flow used by /ai. The legacy lib file is now
  unreferenced and can be removed when ready.

New sibling libs wired (cloned from CremaUIStudio):
  lib-file-ui, lib-card-ui, lib-dashboard-ui, lib-chart-ui,
  lib-map-ui, lib-status-ui.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/components/layout/app-shell.tsx

@@ -25,6 +25,12 @@ import {
   KeyRound,
   Webhook as WebhookIcon,
   CalendarClock,
+  Gauge,
+  UserCheck,
+  Network,
+  ShieldCheck,
+  Megaphone,
+  AlertOctagon,
   // CREMA:NAV-ICONS
 } from "lucide-react"
 
@@ -92,12 +98,19 @@ type NavItem = {
 
 const navItems: NavItem[] = [
   { to: "/", icon: LayoutDashboard, label: "Overview", end: true },
+  { to: "/monitoring", icon: Gauge, label: "Monitoring" },
   { to: "/tenants", icon: Building2, label: "Tenants" },
   { to: "/storage", icon: HardDrive, label: "Storage" },
+  { to: "/buckets", icon: Boxes, label: "Buckets" },
   { to: "/users", icon: UsersIcon, label: "Users" },
+  { to: "/memberships", icon: UserCheck, label: "Memberships" },
+  { to: "/sso", icon: ShieldCheck, label: "SSO" },
   { to: "/secrets", icon: KeyRound, label: "Secrets" },
   { to: "/webhooks", icon: WebhookIcon, label: "Webhooks" },
   { to: "/scheduled-tasks", icon: CalendarClock, label: "Scheduled" },
+  { to: "/networking", icon: Network, label: "Networking" },
+  { to: "/announcements", icon: Megaphone, label: "Announcements" },
+  { to: "/status-page", icon: AlertOctagon, label: "Status page" },
   { to: "/activity", icon: Activity, label: "Audit log" },
   { to: "/ai", icon: Bot, label: "AI" },
   { to: "/settings", icon: Settings, label: "Settings" },