Admin UX overhaul: P0 fixes, error-UX foundations, nav cleanup, tenant detail page

From the 2026-07-14 UI/UX audit (17/40). Four phases:

P1 — Settings route crashed on Agents→Edit (Input/Textarea used but never
imported). Added imports + a shared route-level error boundary
(components/route-error.tsx) re-exported from all shell routes, so one
crashing panel degrades to an explained card with the nav intact instead of
replacing the whole app with a stack trace. Corrected the stale CLAUDE.md
claim that `npm run typecheck` crashes — it works, and would have caught the
missing import.

P2 — Error/empty/feedback foundations. Fixed useSession identity churn that
fired ~3x duplicate fetches per screen and self-inflicted 429s (referentially
stable snapshot). New lib/errors.ts (describeError → plain-language + the fix)
and components/data-state.tsx (DataState renders exactly one of
error/loading/empty/content, so a failed load never shows as "empty";
DialogError for in-dialog failures; 429 auto-retry). Rolled across all 15
list routes; every mutation now toasts. Surfaced+fixed two silent-failure
bugs (sso + buckets-CORS swallowed load errors; the latter could wipe rules
on save).

P3 — Nav IA + trust cleanup. Default-expanded rail; regrouped into 7 coherent
sections; collapsed the Apps/Plan/Entitlements stub triplication into one
honest /billing page; deleted fabricated seeded notifications and the dead
Help menu item; fixed the 403 copy (referenced a tenant switcher that doesn't
exist); removed orphan /assistant + /library routes; gated dev-seed login
hints behind DEV; renamed /activity → /audit-log with a redirect.

P4 — Tenant detail page (routes/tenants.$id.tsx + components/tenant-detail/*),
closing the provision→configure gap. 8 tabs (Overview, Plan & quotas,
Branding, Localization, Email & SMS, Feature flags, IP rules, Inbound
webhooks), each verified saving to the real backend. Row name links to detail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/routes/login.tsx

@@ -21,12 +21,20 @@ export default function LoginRoute() {
     if (session) navigate(next, { replace: true })
   }, [session, next, navigate])
 
+  // This is an operator console: don't advertise dev seed credentials or a
+  // self-serve "Sign up" path in production. Both are dev conveniences.
+  const isDev = import.meta.env.DEV
+
   return (
     <AuthShell>
       <LoginForm
         brand={<AuthBrand />}
         heading={`Sign in to ${brand.name}`}
-        subhead="Use your arcadia credentials. In dev seeds: admin@example.com / AdminP@ssw0rd."
+        subhead={
+          isDev
+            ? "Use your arcadia credentials. In dev seeds: admin@example.com / AdminP@ssw0rd."
+            : "Use your arcadia credentials."
+        }
         onSuccess={async ({ tokens, user, twoFactorRequired, twoFactorChallenge }) => {
           if (twoFactorRequired && twoFactorChallenge) {
             navigate(
@@ -38,7 +46,7 @@ export default function LoginRoute() {
           navigate(next, { replace: true })
         }}
         onForgotPassword={() => navigate("/login/forgot")}
-        onSignup={() => navigate("/signup")}
+        onSignup={isDev ? () => navigate("/signup") : undefined}
       />
     </AuthShell>
   )