feat: show Shadow AI detections in Employee Enrollment

[subomi]

AGE-3362

Stacked on #5901; its ClickHouse schema remains isolated in migration-only #5961. The migration stores signal and category as LowCardinality(String), while #5901 keeps their supported vocabulary closed through Goa and application validation.

Summary

• Show Shadow AI detections on each Employee Enrollment detail page, immediately below Active MCP Connections, and remove the dedicated Shadow AI route and target-to-users drawer.
• Add access.listEmployeeAIDetections, which requires one employee email and project:read on the active project, validates active project/organization consistency, and canonical-folds linked email aliases.
• Keep the unfiltered access.listAIDetections inventory org:admin-only and remove its optional employee filter so project viewers cannot broaden a request into organization-wide results.
• Allow project readers to load the employee roster, expose no device serials, and regenerate Goa, OpenAPI, CLI, and dashboard SDK artifacts.

Motivation

Put device-level AI inventory in the employee context where authorized project viewers investigate enrolled users. A dedicated required-employee endpoint provides that visibility without weakening the organization-wide inventory or creating an enumeration path.

[linear-code]

AGE-3362

[changeset-bot]

🦋 Changeset detected

Latest commit: 320612d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
server	Minor
dashboard	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

cubic analysis

2 issues found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="client/dashboard/src/hooks/useProjectNavRoutes.ts">

<violation number="1" location="client/dashboard/src/hooks/useProjectNavRoutes.ts:102">
P2: According to linked Linear issue AGE-3362, the AI Discovery page must be ungated and visible to all orgs, rendering a setup empty-state CTA for orgs without device-agent activity. Gating the nav item to `org:admin` hides the page (and its setup CTA) from every non-admin org member, so most users never see the feature. Use a project-read scope (e.g. `read`) so the page stays reachable by all members, consistent with the issue's ungated requirement.</violation>
</file>

<file name="client/dashboard/src/components/org-sidebar.tsx">

<violation number="1" location="client/dashboard/src/components/org-sidebar.tsx:257">
P2: According to linked Linear issue AGE-3362, the AI Discovery page must be "Ungated — visible to all orgs", so that orgs without device-agent activity can reach the setup empty state and CTA. This nav item is gated to `scope: "org:admin"` instead. The same org:admin gating was added to `useProjectNavRoutes` and `app-sidebar`, so non-admin members have no way to reach the page or its setup CTA, which contradicts the issue requirement.</violation>
</file>

Linked issue analysis

Linked issue: AGE-3362: feat(dashboard): AI Discovery page — v1 shadow-AI inventory

Status	Acceptance criteria	Notes
✅	Register an AI Discovery page in the Security area at project and organization level.	The page, routes, Secure nav area, and project/org sidebar entries are added.
✅	Render the v1 inventory table with target, category, users, devices, signal, first seen, and last seen.	AIDetectionsTable defines all required columns and renders API-provided display names and categories.
✅	Provide category and team filters using the page-toolbar conventions.	The table defines category and team filters, sources team options from directory-group audiences, and forwards both filters to the API.
✅	Show a device-agent setup empty state with install-docs CTA when the organization has no device-agent activity.	When there are no detections and the derived device-agent feature is false, the page renders a setup empty state linking to the Device Agent page.
⚠️	Keep the page ungated by organization availability and support organizations with active agents but no detections.	The page is not feature-gated by plan or organization state and includes a scanned-clean empty state, but access is restricted to org:admin in the page and navigation.
✅	Update demo seed data so the inventory renders with aggregates and filters in the demo organization.	The seed adds six targets, detection rows, scan receipts, scoped deletes, postflights, and verification steps covering aggregates and filters.
❌	Pass dashboard type-check and build.	The supplied PR context and diff contain no CI or command output demonstrating the type-check and build acceptance criterion.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 51 files (changes from recent commits).

<sub>Tip: instead of fixing issues one by one fix them all with cubic
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 36 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 16 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>