OPER-QA-5 Insights project-scoped surface (Signals feed + Decisions queue + shadow audit)

---
feature_id: FEAT-studio-qa
size: L
module: intake
write_sets:
  - apps/web/src/app/(app)/[team]/projects/[project]/insights
  - packages/ui/src/insights
phi_in_scope: true
has_migration: false
verification_cmd: pnpm --filter @operant/web test
---

## Context

Ratified [REDACTED-DOB] via PDT. Child of OPER-211. See project wiki `concepts/signal-triage-primitive.md` and `concepts/studio-sitemap.md`.

Project-scoped left-nav item at `/[team]/projects/[project]/insights`. Two primary views (Signals, Decisions) plus a shadow-mode audit view visible only during the 30-day shadow window.

## Acceptance Criteria

- Route `/[team]/projects/[project]/insights` gated by getSessionOrThrow() + requirePermission(); membership required
- Signals view: raw feed of all Signals tagged to features owned by this project, filterable by source (IDEA / REQUEST / TICKET / ANALYTICS), by feature, by triage status (untriaged / auto-promoted / awaiting-decision / rejected)
- Decisions view: Tier-2 and Tier-3 DecisionTasks awaiting the decider's input; renders the TriageResult memo inline; approve/modify/reject/defer buttons mirror the PDT memo checkbox format
- Shadow-mode audit view: shows every Tier-1 auto-promoted signal from the last 30 days with its resulting Build ticket link, PR link (when available), and PHI-touched-flag comparison against actual diff. Hidden after shadow window ends.
- Auto-promoted Tier-1 signals never appear in Decisions view
- Queries use getOrgScopedDb() with organization_id RLS; unwrapped queries default-deny
- All PHI-carrying Signal.payload fields render behind explicit reveal controls per phi-guard pattern
- Playwright E2E: verifies filter behavior, decision approval flow writes DecisionTask.decision, cross-tenant isolation (user in org A cannot see org B signals)

---
<!-- admission-passed-on-patch -->
**Admission re-checked on PATCH: PASS** -- feature FEAT-studio-qa admitted to product studio

---
<!-- planner-rescope: phi_no_reviewer -->
**Planner rescope (phi_no_reviewer):** Task has phiInScope=true but no PHI-eligible reviewer is available. Register a reviewer worker advertising the `phi` capability before admitting PHI work.