Team administration & offboarding — roles, pending-invite status, seats, leave/remove

[kipavy]

Part of the team-ux initiative (siblings: #65–#69).

Relates: #67 (pending-invite management overlaps the inbox), #68 (roles & unified panels), #71 (hub is the likely home for admin entry).

Problem

The inviter/admin surface (MembersPage.tsx) is dense and under-designed, and the offboarding side is essentially absent.

Administration (inviter side):

• Roles — assigning/changing roles (owner/manager/editor/member/connect-only) is present but not clearly explained; no per-role "what can this person do" surface.
• Pending invites — status is thin: revoke is a hover-x on PendingInviteCard; there's no clear resend, no "invited but not yet accepted" clarity, no expiry.
• Seats / paywall — the seats usage bar → HTTP 402 → BuySeatsModal path works but is transactional and easy to hit as a wall; the "why is my invite blocked" moment isn't well handled.
• Two-step member removal + undo exists but isn't a coherent, reassuring flow.

Offboarding (missing):

• A member leaving a team — no clear action or consequence explanation.
• An owner removing a member — what visibly happens to that person's access and keys (revocation, re-wrap) is neither surfaced to the admin nor to the removed user.

Proposed reflow

• Clear role model: show what each role grants at the point of assignment; make changes obviously reversible.
• First-class pending-invite management: status (invited / accepted / expired), resend and revoke as explicit actions, consistent with the receive-side inbox (Unified team notification inbox — invites, shared sessions & control requests through the bell + toasts #67).
• Seat UX that isn't a wall: surface seat usage before the invite is blocked; make the buy-more path calm and explain what a seat is.
• Explicit offboarding: "Leave team" and "Remove member" as honest flows that state the access/key consequences, with confirmation.

Decisions (brainstorm 2026-07-24)

• Filed as one issue (per brainstorm) since it's all the same admin surface; may split into "member/role/seat administration" and "offboarding" if it grows.
• Role set and panel unification are coordinated with Explicit "Share" verb for vaults — a real share sheet, and unify the two invite panels #68 (don't diverge role vocabularies).

Still open

• Whether admin lives in the Team hub (Team hub + first-time mental model (end silent team creation; teammates directory) #71), stays per-vault in MembersPage, or both.
• Key-revocation UX + what the removed user sees.
• Seat model presentation (per-user? explain trial seat-clamp behavior).
• Split vs. keep-as-one decision.