Template manage list and editor

## Epic requirement (verbatim) > - Operator will manage the library (CRUD) - standard style: list, tabbed detail. Reuse Task Edit code > - A template will have an accompanying image to graphically explain what it does The settled inputs are the PRD (Task 11059) and the architecture (Task 11060) §4. C1's API, C1b's asset routes and C2's starters are merged. ## Scope - **`/templates/manage`:** a `ui/feed/FeedList` with the ListDetail split pane (`lib/listDetail.ts`). - Columns: name, purpose group, origin, status (draft/published) and starts in the last 90 days. - A server search box (`GET /api/templates/manage?q=`). - **`/templates/new` and `/templates/:id`:** `ui/detail/DetailPage` with `components/Tabs`, the tab in the URL via `hooks/useUrlTab`, and one Save bar that stays disabled until something changes. - **Task** tab: `TaskSpecFields` under a new `'template'` context. It reuses the `automation` context's staged pasted-image path (`TaskSpecFields.tsx:735-760`), uploading to `/api/templates/{id}/assets` once the row exists. It hides project, feature, assignee and playbook (N-6), and keeps Depth, Involvement, Persona and Model. - **Library** tab: name, summary, purpose group, image upload (card_image) with preview, featured, and draft/published. - **Delete:** a confirm dialog that names the automation count from `GET /api/templates/{id}/usage`. - **Who sees it:** the operator (global, plus the org they are acting in) and org template editors (`templates:edit` with the switch on). With the switch off, an org admin gets no manage view and no route. - **Routes:** add them in `routeGroups.ts` and `App.tsx`. The sidebar item is C4's. ## Acceptance criteria (verbatim) - **AC-1 Operator list.** Oracle: sign in as the operator, open `/templates/manage`. Expected: a `FeedList` of every template with name, purpose group, origin, status and starts in the last 90 days, plus a working search box. Selecting a row opens its detail in the split pane. The row is never a modal. Fails if names are cut to a few characters at desktop width. - **AC-2 Tabbed detail that reuses Task Edit.** The template detail uses `DetailPage` + `Tabs` with the tab in the URL. Tabs: **Task** (the same field components as `TaskEditForm`: title, description with rich text and pasted images, persona, depth, involvement, model) and **Library** (name, summary, purpose group, image, featured, draft or published). One Save bar, disabled until something changes. Oracle: edit the description and persona, Save, reload, and see the new values. The rendered description looks the same as on a task. - **AC-3 Create.** Oracle: from `/templates/manage`, open New. It goes to `/templates/new`, the same page in create mode. Expected: save as draft; the template appears in the list and **not** in the gallery. Publish it; it appears in the gallery. - **AC-4 Delete (manage half).** Expected: the confirm names how many automations will stop. Afterwards it is gone from the manage list. (C5 owns the full end-to-end AC-4 oracle.) - **AC-5 Image.** Oracle: upload a PNG, JPG, WebP or SVG on the Library tab, Save, and open the gallery. Expected: the card shows the image, sharp at its rendered size, not stretched, cropped at most to the card's aspect ratio. An image over the size cap is refused with a message naming the cap. A template without an image shows its purpose-group placeholder. - **AC-13 Plan switch (manage half).** Oracle, switch off: as an org admin … no manage view. The API refuses org template writes with 403. Oracle, switch on: the admin sees … a manage list of the org's own templates. - **AC-20 Live on dev.** AC-1 through AC-19 pass on `dev.jaah.ai` after the deploy. Nothing global sits behind a flag that is off in the dev deployment. On "appears in the gallery" (AC-3, AC-5): C4 builds the gallery in the same phase. If C4 has not merged yet, verify through `GET /api/templates`. Finish re-checks it in the UI. Credentials & reach: - UI ACs as the operator (AC-1–5, 17, 19, 20) | `me/jaah/debug/main/operator-login` (operator identity; switches between the operator and tenants), environment `https://app.dev.jaah.ai` | **verified**: the credential is on the roster and `credential_get` succeeded; an HTTPS GET of app.dev.jaah.ai returned 200 from this node. `dev.jaah.ai` (internal ALB) timed out from here, so oracles use `app.dev.jaah.ai` - Org A / org B isolation and switch on/off (AC-13, 14) | Same operator login (acts in any tenant; the admin covers the org admin) + `org/console/dev-orgb-login` as org B's own admin | **verified**: both `credential_get` calls succeeded. Note: the org B row's stored base_url names a retired host; use app.dev.jaah.ai Out of scope: - N-1 No change to Playbooks (`apps/web/src/pages/playbooks/`, `apps/api/app/playbook_*.py`, `routes/playbooks.py`) and no template↔playbook link. - N-3 No fill-in inputs, `{{placeholders}}` or variables in template text (D3). - N-5 No version history or revert for templates. - N-6 Templates carry no project, feature, assignee, Jira key, priority or playbook (D7). - N-8 No change to other sidebar items or their order beyond adding **Templates**. - N-9 Existing Tasks list behavior is unchanged when tasks exist (AC-16). - Do NOT touch: the gallery, the Start dialog or Customize (C4); the automation UI (C5); the API contract (C1 and C1b; report any gap you find). The existing `task` and `automation` contexts of `TaskSpecFields` must behave exactly as before. Done means: - AC-1–AC-5 and AC-13 (manage half) pass on app.dev.jaah.ai as the operator, in a browser at desktop width AND at 448px. Attach screenshots of the list, the Task tab and the Library tab at both widths. - Fails if any page scrolls horizontally at 448px or a name is cut at desktop width. - Fails if the Save bar is enabled before an edit. - Fails if the rendered template description differs visibly from the same text on a task. - AC-5: on dev, a 3 MB image is refused with a message naming 2 MiB. - AC-13: with the switch off, an org B admin (`org/console/dev-orgb-login`) gets no manage entry and `/templates/manage` shows no org rows or write buttons. With the switch on (per-org override in Settings), the admin can create an org template. - Vitest covers the `template` context: hidden fields, the staged paste, and the upload going to the template assets route. Existing TaskSpecFields tests stay green.