[People] Roadmap: People, Soci and census across auth, backend and admin #146

This is the root of the People work across auth, backend and admin. Until now People was built without a clear direction. This issue sets the direction, records what happens to the existing code and PRs, and links every piece of work. Reviews of People PRs are paused until the sub-issues below say otherwise.

Phases

Progress shows in the sub-issue tree below. Each issue's order is set with GitHub "blocked by" links.

Decisions (29 October 2026)

1. Three separate concerns, little overlap. Phase 1 is People ↔ Auth accounts ↔ RBAC roles. Soci and fees (Phase 2) and the census (Phase 3) are separate, and are built after it.
2. People without a linked account live only in the backend, never as placeholder users in Auth. We often don't know which account someone will sign in with (Entra ID if they're a socio, otherwise any Google account), and the email and name we have may not match it.
3. Linking: an email invite the person accepts by signing in with any account, or a manual link by someone with the new people:link permission. No automatic matching.
4. Only predetermined roles: roles bound in Auth to admin, capo, team:<key>:member or team:<key>:lead, never with idp:* permissions. Clearance comes from RBAC, and Auth checks it on every change.
5. Capo Admin is part of Phase 1 (the capo-admin role already exists). Capo Admins may later manage the admins under them. That's not built now, but it's designed for.
6. Soci in People is removed outright, to be rebuilt from scratch on Entra ID users in Phase 2.
7. Nothing is migrated. Every People table holds only test data.
8. Administrative capabilities are RBAC permissions, not hard-coded Master Admin checks (e.g. binding a role to People).

What's in production

• admin: a People area with Overview, Admins, Teams, Census, Linking, Capo Admin, My area, the Soci register, fees and receipts: feat(people): add people records, roles and census workflows #97, feat(people): add fee renewal and signed receipts #100, fix(people): accept unknown Telegram group admins in the Capo area #134. It's empty and not connected to RBAC.
• backend: the people.* API (feat(people): add the people api for the admin dashboard backend#83, fix(people): classify pending telegram admin removals backend#94). It holds all of that, plus creating Microsoft 365 accounts and the eSign receipt bridge.
• auth: no People code on main.
  • people:* permissions exist, granted to direttivo and it-lead.
  • Team roles (hr-*, design-*, intl-*, events-*) and capo-admin exist, but nothing binds them to People yet.

What happens to the open PRs

Older issues covering parts of this: #23, #24, #25.

How to follow along

• Every issue has the people label, and its title starts with [People], [People · Cleanup] or [People · Phase N].
• Each repo issue is a sub-issue of its phase, and each phase is a sub-issue of this one.
• PRs should say Closes <issue> so progress rolls up here.