epic: wire the console to the real eERC backend (retire the demo-era contract)

[hitakshiA]

Why

Wiring console.benzo.space to the live BenzoNet L1 BFF surfaced a full API-contract mismatch: the console's api.ts targets ~55 endpoints the eERC backend (benzo/services/api, Fastify) does not implement. The console is the retired Stellar-era enterprise console running on demo stubs — never integrated with the Avalanche eERC backend (Stellar vocabulary like stroops/issuer/assetCode is still in its types).

Decision (2026-07-10): scope the console down to the backend's real contract (option A), keeping the full console in demo mode as the product vision.

Contract reconciliation reference: https://claude.ai/code/artifact/aad6f6dd-ceee-4bb7-9ca7-ceba81d39298

Principle

• Real mode (VITE_DEMO_MODE unset): expose ONLY backend-backed features; everything wired to a real endpoint or it is not shown.
• Demo mode (VITE_DEMO_MODE=1): unchanged — full console, seeded, no network. The vision demo survives untouched.
• Backend is the source of truth (cookie SIWE). The wallet already conforms and is Fuji-tested.

Backend surface the console CAN use

auth (cookie SIWE) · orgs + members · org-scoped treasury (deposit / fund-intent / balances / deposits) · payroll run (CSV → start/pause/resume + progress via SSE) · onboarding (start / status / status-stream) · identity (handles / contacts / invites) · activity + receipts · auditor (events / report / packet) · disclosure · onramp.

No backend → stays demo-only, hidden in real mode

payments & approvals engine · invoices · viewing-grants · approval-policies · integrations · ledger + private-audit packets · the 4-proof payroll UX · accounts/counterparties roster · dashboard rollups.

Sequenced plan (each lands as its own PR: codex → gate → review → merge)

• A · Foundation — real cookie-SIWE auth + user/org session model (blocks everything)
• B · Real-mode gating — nav/route table hides the no-backend domains when !DEMO_MODE
• C · Onboarding — POST /orgs + /onboarding/start + status stream + POST /orgs/:id/treasury provision
• D · Treasury — org-scoped GET /orgs/:id/treasury, /deposit, /fund-intent, /deposits
• E · Payroll — POST /orgs/:id/payroll (CSV) + GET /payroll/:runId (JSON+SSE) + start/pause/resume; replace the 4-proof UX with progress counts
• F · (optional) Auditor packet + activity — map Auditor-access + Audit-log to /auditor/packet + /activity

[hitakshiA]

Step A (foundation auth) ✅ merged (#60, closed #59).

Reordering the remaining steps to wire the real features before trimming the nav: C (onboarding) → D (treasury) → E (payroll) → B (real-mode gating, last). Gating is cleanest once the real feature screens exist. Starting C now.

[hitakshiA]

Step C (onboarding) ✅ merged (#63, closed #62). Login → create org → eERC onboarding (streamed) → provision treasury → workspace now works in real mode. Starting D (treasury screen).

[hitakshiA]

Step D (treasury) ✅ merged (#65, closed #64). Treasury is org-scoped (balances + Add-funds deposit + deposits history). Note: Pay's per-account balance was stubbed (deferred to B — Pay is a no-backend screen). Starting E (payroll — flagship).