feat: sidebar nav (default), group member management, per-customer ticketing identity mapping

- Navigation: new per-user setting (default "side") renders the page links as a
  left sidebar while keeping theme/bell/avatar/logout in the top-right; falls
  back to a top bar under 760px or when set to "top". Profile selector added.
- Group conversations: record a creatorId; the creator gets a "Manage members"
  button to add/remove participants (new GET/POST/DELETE members endpoints,
  creator-only). Existing groups backfilled.
- Customer ticketing: admin can map each assigned consultant to their username
  in that customer's ticketing system. Per-customer mapping takes precedence
  over the consultant's global ticketingIdentities during sync.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/admin_customers.go

@@ -19,16 +19,17 @@ import (
 // customerPayload is the create/update body. Credentials are write-only:
 // they are encrypted at rest and never returned.
 type customerPayload struct {
-	Name          *string               `json:"name"`
-	Type          *domain.TicketingType `json:"type"`
-	BaseURL       *string               `json:"baseUrl"`
-	ProjectKey    *string               `json:"projectKey"`
-	Credentials   *syncpkg.Credentials  `json:"credentials"`
-	PollInterval  *int                  `json:"pollIntervalSec"`
-	ConsultantIDs *[]string             `json:"consultantIds"`
-	DefaultBudget *float64              `json:"defaultBudget"`
-	Archived      *bool                 `json:"archived"`
-	Version       *int64                `json:"version"`
+	Name                 *string               `json:"name"`
+	Type                 *domain.TicketingType `json:"type"`
+	BaseURL              *string               `json:"baseUrl"`
+	ProjectKey           *string               `json:"projectKey"`
+	Credentials          *syncpkg.Credentials  `json:"credentials"`
+	PollInterval         *int                  `json:"pollIntervalSec"`
+	ConsultantIDs        *[]string             `json:"consultantIds"`
+	ConsultantIdentities *map[string]string    `json:"consultantIdentities"`
+	DefaultBudget        *float64              `json:"defaultBudget"`
+	Archived             *bool                 `json:"archived"`
+	Version              *int64                `json:"version"`
 }
 
 func (s *Server) sealCredentials(creds syncpkg.Credentials) (string, error) {
@@ -63,8 +64,9 @@ func customerJSON(c *domain.Customer) map[string]any {
 			"type": c.Ticketing.Type, "baseUrl": c.Ticketing.BaseURL,
 			"projectKey": c.Ticketing.ProjectKey, "pollIntervalSec": c.Ticketing.PollIntervalSec,
 			"lastSyncAt": c.Ticketing.LastSyncAt, "lastSyncStatus": c.Ticketing.LastSyncStatus,
-			"lastSyncError":  c.Ticketing.LastSyncError,
-			"hasCredentials": c.Ticketing.CredentialsEnc != "",
+			"lastSyncError":        c.Ticketing.LastSyncError,
+			"hasCredentials":       c.Ticketing.CredentialsEnc != "",
+			"consultantIdentities": c.Ticketing.ConsultantIdentities,
 		},
 		"consultantIds": c.ConsultantIDs, "defaultBudget": c.DefaultBudget,
 		"archived": c.Archived, "createdAt": c.CreatedAt, "updatedAt": c.UpdatedAt,
@@ -99,6 +101,18 @@ func (s *Server) handleAdminGetCustomer(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, http.StatusOK, map[string]any{"customer": customerJSON(c)})
 }
 
+// cleanIdentities trims values and drops empty mappings so we don't persist
+// blank usernames for consultants the admin left unmapped.
+func cleanIdentities(in map[string]string) map[string]string {
+	out := map[string]string{}
+	for k, v := range in {
+		if t := strings.TrimSpace(v); t != "" {
+			out[k] = t
+		}
+	}
+	return out
+}
+
 func (s *Server) validateConsultants(ctx context.Context, ids []string) (string, bool) {
 	for _, id := range ids {
 		u, err := s.store.UserByID(ctx, id)
@@ -156,6 +170,9 @@ func (s *Server) handleAdminCreateCustomer(w http.ResponseWriter, r *http.Reques
 		}
 		c.ConsultantIDs = *req.ConsultantIDs
 	}
+	if req.ConsultantIdentities != nil {
+		c.Ticketing.ConsultantIdentities = cleanIdentities(*req.ConsultantIdentities)
+	}
 	creds := syncpkg.Credentials{}
 	if req.Credentials != nil {
 		creds = *req.Credentials
@@ -236,6 +253,10 @@ func (s *Server) handleAdminPatchCustomer(w http.ResponseWriter, r *http.Request
 		set["consultantIds"] = *req.ConsultantIDs
 		diff["consultantIds"] = *req.ConsultantIDs
 	}
+	if req.ConsultantIdentities != nil {
+		set["ticketing.consultantIdentities"] = cleanIdentities(*req.ConsultantIdentities)
+		diff["consultantIdentities"] = "updated"
+	}
 	if req.DefaultBudget != nil {
 		set["defaultBudget"] = *req.DefaultBudget
 		diff["defaultBudget"] = *req.DefaultBudget