docs: publish governance, governed boosts, receipts, OIDC phase 2, files SSO

Engineering guide: session/refresh/logout architecture, publish-governance
and amplify gating sections, file map to migrations 001-034. Admin guide:
governance administration, files-SSO operations, verification harnesses,
migration list + deploy order + 034 session note. User manual: calendar
receipt badges, boost gating, connections governance note (replaces the
stale 'stub' statuses). Design doc 2026-10-13: marked implemented with the
as-shipped phase 2. Wiki (EN/ES): Drive sign-in + boosts/approvals.
README: governance + Files SSO bullets.

docs/design/2026-10-13-files-oidc-sso.md

@@ -1,6 +1,7 @@
 # Files SSO design — Hub as the OIDC issuer for oCIS
 
-Status: proposed (design pass; not implemented)
+Status: **implemented** (phase 1: provider + sign-in, shipped; phase 2: session-bound
+refresh tokens + logout propagation, shipped — see §Phases update below)
 Date: 2026-10-13
 Related: docs/design/2026-10-12-collectives-architecture.md, brand review P0 #2
 (files.occupymedia.cc navy login wall), matrix-sso module (chat SSO, shipped).
@@ -67,12 +68,31 @@ already holds the session, the RBAC roles, and the username namespace.
 ## Phases
 
 1. **Provider + sign-in** (≈1–2 days): the module above; Drive view switches
-   `authMode` to `"oidc"`; the navy wall disappears.
+   `authMode` to `"oidc"`; the navy wall disappears. **Shipped.**
 2. **Personal drives** (≈1 day): uploaded files land in the user's own drive;
-   the Library keeps serving collective folders from the service account.
+   the Library keeps serving collective folders from the service account. **Shipped** (autoprovisioned personal spaces verified live).
 3. **Share-through** (≈1 day, optional): group folders shared into members'
    drives so the Drive tab also shows collective Library content; only then
-   consider deprecating the Library tab.
+   consider deprecating the Library tab. *(open)*
+
+## Phase 2 as shipped (refresh + logout, migration 034)
+
+The security note below said logout propagation was a nice-to-have; it shipped
+as part of hardening instead:
+
+- `auth_sessions` rows (`sid` in the session payload): login/reissue write the
+  row, `POST /auth/logout` revokes it, `reissue` refuses revoked or pre-034
+  tokens. Request validation stays stateless.
+- `oidc_refresh_tokens`: opaque tokens, SHA-256 at rest, rotate-on-use,
+  `family_id` chains with reuse detection (presenting a consumed token revokes
+  the chain). Every refresh re-checks the session row and active membership —
+  so an oCIS session can never outlive the Hub sign-in that minted it, and
+  logout propagates within one access-token TTL (≤1 h).
+- The token endpoint is unauthenticated: lookups go through the definer-rights
+  `oidc_refresh_lookup()` (audit_append pattern). Refresh TTL has no constant —
+  it *is* the Hub session's remaining lifetime.
+- Matrix SSO stays out of propagation scope by design: the broker mints
+  2-minute `m.login.token`s and Element holds a Matrix-native session after.
 
 ## Security notes