docs: Backup & Restore, Grants grid, and first-run sign-in

[cursor]

Weekly documentation pass against main since 2026-09-28. Updates existing guides only — no new pages.

Docs added/updated

• USER_GUIDE.md — Utils → Backup & Restore; Access → Grants vs Diff; first-run sign-in; idle sessions / Sign out other sessions.
• CODE_MAP.md / ARCHITECTURE.md / DIALECTS.md / CONTRIBUTING.md — where backup command builders live, dialect checklist, npm run test-ids.
• UNRELEASED.md — ship notes for backup, held grants, sessions.
• security-process.md — lockfile is committed; audit uses npm ci.

Codepaths covered

• packages/sql/.../backup.ts + providers/<d>/*.backup.ts + GET/PUT /api/backup-settings
• Access Grants grid (heldGridPermissions / compileGridChanges) vs Permission Diff
• Auth setup page, FOX_SESSION_IDLE_HOURS, profile Sign out other sessions
• Test-ID catalog / MCP (scripts/test-ids/)

Gaps addressed

• Backup & Restore shipped (PR feat(utilities): Backup & Restore — commands per engine, with saved defaults #477) with no user or contributor docs; easy to think Fox runs the dump.
• Grants grid used to look empty and revoke everything else a role held; that is no longer the behavior.
• First run still described only the optional welcome wizard, not required admin sign-in.
• DIALECTS.md was still called gitignored; security docs still said the lockfile was gitignored.

  

---

Note

Low Risk
Documentation and contributor-guide updates only; no runtime, auth, or backup execution logic is modified in this diff.

Overview
This PR is a documentation-only pass that brings user, architecture, and contributor guides in line with recently shipped behavior—no application code changes.

User-facing (USER_GUIDE.md, UNRELEASED.md) documents Utils → Backup & Restore (command generation vs confirmed server-side SQL backup only; restores never auto-run), reframes first run as required admin sign-in/setup code, explains Access → Grants (grid opens on held privileges; SQL is diff-only; Diff is separate), and adds 8-hour idle sessions plus Sign out other sessions.

Contributor / map docs (ARCHITECTURE.md, CODE_MAP.md, DIALECTS.md, CONTRIBUTING.md, agent memory) point backup work at *.backup.ts, backup.registry.ts, and packages/server/.../backup for GET/PUT /api/backup-settings; note DIALECTS.md is tracked (not gitignored); and document the E2E data-testid catalog (byTestId, npm run test-ids, MCP).

Security docs now state package-lock.json is committed and CI audit uses npm ci.

^{Reviewed by Cursor Bugbot for commit 6660789. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 12f622f3-d268-4c94-870b-fa1b09fe558d)