Task: The IAM read-only surfaces: permission, session and session statistics

Implement the entities that are never written from the browser. permission is a catalogue with no version and no audit fields, so it is a read-only list. session is observational, so it is a read-only list sorted most-recent-first with no save and no delete. Session statistics are shown, or the screen says the figures are not modelled, which is what the service answers today.

• No save, edit or delete action is offered on any of the three.
• The session list is most-recent-first.
• The screens meet the same state requirements as a writable one: loading, empty, filtered-empty, error and unauthorized.
• permission's lack of a version and an audit trail is recorded as the reason it is read-only.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Superseded on 2026-09-23. These three were to be read-only surfaces on the shared shell, and the shell is deleted. The session and permission data stay available through the protocol layer, and a journey shows what its own steps require.