Internal change. Added team_members.areaAccess, team_members.status, team_members.leaveUntil and the team_member_areas table (migration 2188), with every member set to every area. Added TeamAreaAccess, the one answer to whether a person can use an area in a team; AreaRegistry and RequestArea, which name the area each page, job and API resource is in; and AreaGate, which refuses a member outside their areas from the sign-in check, the API router and the endpoints with their own sign-in. TeamService::membership() answers for the request's area, so every existing access check follows. Search, Recent work, the sidebar, the ⌘K palette, the settings search, the Dashboard, the app's catalogue, the Calendar's layers, Google Calendar copies, the assistant's tools and the member lists ask per area. AreaRegistryTest fails for an entry point with no area. The pages where admins choose areas are not built yet, so no member is limited.
One access check for the areas a team member can use
Added the check that will let a team admin limit a member to some of the team's areas. Nothing changes for anyone yet: every member keeps every area.