feat(privacy): surface LLM data-egress destination to users

Transparency indicator (frontend audit rank 11): a notice in the AI surface
telling users their prompts/data are sent to the configured provider, and that
non-local providers are third-party services. Does not change data flow — the
full fix (route egress through arcadia-llm-gateway with redaction) is gated on
that gateway being deployed. Uses universal theme tokens; finance builds clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/routes/assistant.tsx

@@ -1059,6 +1059,16 @@ function AssistantSurface({
         </div>
       )}
 
+      <p
+        data-slot="llm-egress-notice"
+        className="rounded-md border border-border bg-muted/50 px-3 py-2 text-xs text-muted-foreground"
+      >
+        <strong className="text-foreground">Where your data goes:</strong> your
+        messages — plus any platform data the assistant pulls in (tenant, user,
+        and billing rows) — are sent to the operator-configured LLM provider.
+        Unless that's a local model, it's a third-party service.
+      </p>
+
       <div
         ref={scrollerRef}
         className="flex-1 overflow-y-auto rounded-lg border bg-card/30 p-4"

start.sh

@@ -9,7 +9,7 @@ LOG_FILE=".demo.log"
 if [ -f "$PID_FILE" ]; then
   existing="$(cat "$PID_FILE")"
   if [ -n "$existing" ] && kill -0 "$existing" 2>/dev/null; then
-    echo "arcadia-admin already running (pid $existing)"
+    echo "crema-app-aifirst-template already running (pid $existing)"
     exit 0
   fi
   rm -f "$PID_FILE"
@@ -20,4 +20,4 @@ pid=$!
 echo "$pid" >"$PID_FILE"
 disown "$pid" 2>/dev/null || true
 
-echo "arcadia-admin started (pid $pid) — logs: $LOG_FILE"
+echo "crema-app-aifirst-template started (pid $pid) — logs: $LOG_FILE"

stop.sh

@@ -6,7 +6,7 @@ cd "$(dirname "$0")"
 PID_FILE=".demo.pid"
 
 if [ ! -f "$PID_FILE" ]; then
-  echo "arcadia-admin not running (no .demo.pid)"
+  echo "crema-app-aifirst-template not running (no .demo.pid)"
   exit 0
 fi
 
@@ -15,9 +15,9 @@ pid="$(cat "$PID_FILE")"
 if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
   pkill -P "$pid" 2>/dev/null || true
   kill "$pid" 2>/dev/null || true
-  echo "arcadia-admin stopped (pid $pid)"
+  echo "crema-app-aifirst-template stopped (pid $pid)"
 else
-  echo "arcadia-admin pid $pid not alive, cleaning up"
+  echo "crema-app-aifirst-template pid $pid not alive, cleaning up"
 fi
 
 rm -f "$PID_FILE"