feat(door): member self-entry on the dashboard (locked design)

selfEntry({connectionId}): any active member with >=1 active card on file
may trigger a momentary open on a connection that is enabled and has
allow_member_self_entry on (locked rule: any active card, no slot row
required). Membership/cards resolved server-side so a member can only open
for themselves; never unlock/lock/grant/revoke; never anonymous. Strict
5/min per-member rate limit, one redacted self_entry audit row (denials
audited too), through the existing hardened executor. listSelfEntryDoors
returns the enabled self-entry connections only when the caller has an
active card, so the dashboard 'Door access' panel is hidden for
ineligible members. API_REFERENCE + ARCHITECTURE + HANDOFF pass-28.

app/(app)/dashboard/door-self-entry.tsx

@@ -0,0 +1,42 @@
+'use client'
+
+import { useState } from 'react'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import { useConfirm } from '@/components/ui/confirm'
+import { selfEntry } from '@/lib/actions'
+
+type Door = { id: string; name: string }
+
+export function DoorSelfEntry({ doors }: { doors: Door[] }) {
+  const confirm = useConfirm()
+  const [busy, setBusy] = useState<string | null>(null)
+
+  async function open(d: Door) {
+    const ok = await confirm({
+      title: `Open ${d.name}?`,
+      description:
+        'This sends a live command that physically opens the door. Only do this if you are at the door and authorized to enter.',
+      confirmText: 'Open the door',
+    })
+    if (!ok) return
+    setBusy(d.id)
+    const res = await selfEntry({ connectionId: d.id })
+    setBusy(null)
+    if ('error' in res && res.error) return toast.error(res.error)
+    toast.success(`${d.name} opened`)
+  }
+
+  return (
+    <div className="bg-card rounded border border-border divide-y divide-border">
+      {doors.map(d => (
+        <div key={d.id} className="flex items-center justify-between gap-3 px-4 py-3">
+          <span className="font-sans text-sm text-foreground truncate">{d.name}</span>
+          <Button size="sm" disabled={busy === d.id} onClick={() => open(d)}>
+            {busy === d.id ? 'Opening…' : 'Open'}
+          </Button>
+        </div>
+      ))}
+    </div>
+  )
+}