Add Buckets, Monitoring, Memberships, Networking, SSO, Announcements, Status page

Full set of admin surfaces on top of /platform/* and /admin/* endpoints,
plus a migration of /assistant onto @crema/llm-providers-ui.

Buckets (/buckets):
  S3-level CRUD over /platform/buckets — list, create, delete (with the
  6-digit confirmation flow the backend enforces), per-bucket configure
  for versioning / CORS rules / policy JSON, plus an object browser
  with FileGrid/FileList from @crema/file-ui and presigned-URL reveal.
  Storage-config picker scopes the view to one credential at a time.

Monitoring (/monitoring):
  Live dashboard. Service health board derived from indirect signals
  (status-ui OverallStatus + ComponentRow). KPI tiles for sessions,
  jobs, audit. Tabs: background jobs (Donut + BarChart + retry recent),
  sessions (Sparkline of last 24h sign-ins), audit activity (BarChart
  of severity / top resource types), infrastructure (DO summary +
  WorldMapSvg coloured by droplet region + droplet list + Spaces),
  rate limits. 30s auto-refresh.

Memberships (/memberships):
  M:N glue between users and tenants over /admin/memberships. Add /
  edit / suspend / activate / remove with role multi-select.

Networking (/networking):
  Tabs over /platform/{firewalls,vpcs,domains,floating_ips}.
  Read/delete on firewalls, read on VPCs, full DNS-record CRUD, and
  inline assign/unassign for floating IPs.

SSO (/sso):
  /sso/identity-providers CRUD with PEM cert as write-only field, plus
  /sso/sessions list with destroy.

Announcements (/announcements):
  /admin/announcements CRUD. Platform-wide vs per-tenant audience,
  schedule windows, dismissible + active toggles.

Status page (/status-page):
  /admin/status-page/{components,incidents,subscribers}. Components
  CRUD, incidents with timeline + post-update + resolve flow,
  subscriber list. Public preview at the top using StatusBoard +
  IncidentTimeline from @crema/status-ui.

Assistant migration:
  /assistant now uses @crema/llm-providers-ui (provider catalog +
  vault key resolution) instead of ~/lib/llm-settings. Same async
  buildAdapter() flow used by /ai. The legacy lib file is now
  unreferenced and can be removed when ready.

New sibling libs wired (cloned from CremaUIStudio):
  lib-file-ui, lib-card-ui, lib-dashboard-ui, lib-chart-ui,
  lib-map-ui, lib-status-ui.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/lib/arcadia/networking.ts

@@ -0,0 +1,162 @@
+// Networking helpers: firewalls, VPCs, domains + DNS records, floating IPs.
+// Backend: /api/v1/platform/{firewalls,vpcs,domains,floating_ips,...}.
+
+import type { ArcadiaClient } from "@crema/arcadia-client"
+
+const BASE = "/api/v1/platform"
+
+// --- Firewalls ----------------------------------------------------------
+
+export interface Firewall {
+  id: string | number
+  name: string
+  status?: string
+  inbound_rules?: unknown[]
+  outbound_rules?: unknown[]
+  droplet_ids?: Array<string | number>
+  created_at?: string
+  [key: string]: unknown
+}
+
+export async function listFirewalls(arcadia: ArcadiaClient): Promise<Firewall[]> {
+  try {
+    const res = await arcadia.GET<{ firewalls?: Firewall[]; data?: Firewall[] }>(
+      `${BASE}/firewalls`,
+    )
+    return res.firewalls ?? res.data ?? []
+  } catch {
+    return []
+  }
+}
+
+export async function createFirewall(
+  arcadia: ArcadiaClient,
+  input: Partial<Firewall>,
+): Promise<unknown> {
+  return arcadia.POST(`${BASE}/firewalls`, { body: input })
+}
+
+export async function deleteFirewall(
+  arcadia: ArcadiaClient,
+  id: string | number,
+): Promise<void> {
+  await arcadia.DELETE(`${BASE}/firewalls/${id}`)
+}
+
+// --- VPCs ---------------------------------------------------------------
+
+export interface Vpc {
+  id: string
+  name: string
+  region?: string
+  ip_range?: string
+  default?: boolean
+  created_at?: string
+  [key: string]: unknown
+}
+
+export async function listVpcs(arcadia: ArcadiaClient): Promise<Vpc[]> {
+  try {
+    const res = await arcadia.GET<{ vpcs?: Vpc[]; data?: Vpc[] }>(`${BASE}/vpcs`)
+    return res.vpcs ?? res.data ?? []
+  } catch {
+    return []
+  }
+}
+
+// --- Domains + DNS records ----------------------------------------------
+
+export interface Domain {
+  name: string
+  ttl?: number
+  zone_file?: string | null
+  [key: string]: unknown
+}
+
+export interface DnsRecord {
+  id: string | number
+  type: string
+  name: string
+  data: string
+  priority?: number | null
+  port?: number | null
+  ttl?: number
+  weight?: number | null
+  [key: string]: unknown
+}
+
+export async function listDomains(arcadia: ArcadiaClient): Promise<Domain[]> {
+  try {
+    const res = await arcadia.GET<{ domains?: Domain[]; data?: Domain[] }>(`${BASE}/domains`)
+    return res.domains ?? res.data ?? []
+  } catch {
+    return []
+  }
+}
+
+export async function listDnsRecords(
+  arcadia: ArcadiaClient,
+  domainName: string,
+): Promise<DnsRecord[]> {
+  const res = await arcadia.GET<{ domain_records?: DnsRecord[]; data?: DnsRecord[] }>(
+    `${BASE}/domains/${encodeURIComponent(domainName)}/records`,
+  )
+  return res.domain_records ?? res.data ?? []
+}
+
+export async function createDnsRecord(
+  arcadia: ArcadiaClient,
+  domainName: string,
+  input: { type: string; name: string; data: string; ttl?: number; priority?: number },
+): Promise<unknown> {
+  return arcadia.POST(`${BASE}/domains/${encodeURIComponent(domainName)}/records`, {
+    body: input,
+  })
+}
+
+export async function deleteDnsRecord(
+  arcadia: ArcadiaClient,
+  domainName: string,
+  recordId: string | number,
+): Promise<void> {
+  await arcadia.DELETE(
+    `${BASE}/domains/${encodeURIComponent(domainName)}/records/${recordId}`,
+  )
+}
+
+// --- Floating IPs -------------------------------------------------------
+
+export interface FloatingIp {
+  ip: string
+  region?: { slug?: string; name?: string } | string
+  droplet?: { id: number | string; name?: string } | null
+  [key: string]: unknown
+}
+
+export async function listFloatingIps(arcadia: ArcadiaClient): Promise<FloatingIp[]> {
+  try {
+    const res = await arcadia.GET<{ floating_ips?: FloatingIp[]; data?: FloatingIp[] }>(
+      `${BASE}/floating_ips`,
+    )
+    return res.floating_ips ?? res.data ?? []
+  } catch {
+    return []
+  }
+}
+
+export async function assignFloatingIp(
+  arcadia: ArcadiaClient,
+  ip: string,
+  dropletId: number | string,
+): Promise<unknown> {
+  return arcadia.POST(`${BASE}/floating_ips/${ip}/assign`, {
+    body: { droplet_id: dropletId },
+  })
+}
+
+export async function unassignFloatingIp(
+  arcadia: ArcadiaClient,
+  ip: string,
+): Promise<unknown> {
+  return arcadia.POST(`${BASE}/floating_ips/${ip}/unassign`)
+}