feature plus ux rearrangements

frontend/src/routes/[fam]/+layout.server.ts

@@ -1,5 +1,6 @@
-import { pbAdmin, createPbClient } from '$lib/server/pocketbase';
+import { createPbClient } from '$lib/server/pocketbase';
 import { createServices, type ChatActor } from '$lib/server/services';
+import { ensureFamAccess } from '$lib/server/access';
 
 async function paydayCheck(famId: string, pbToken: string) {
 	try {
@@ -48,19 +49,30 @@ export async function load(event) {
 
 	let famId = '';
 	let chat: { famId: string; actor: ChatActor } | null = null;
+	let fam: any = null;
+	let famAccess = { disabled: false, mode: 'none' as 'none' | 'code' | 'sub' | 'canceled', reason: '' };
 
 	if (session && pbToken) {
 		famId = session.famId;
 		await paydayCheck(famId, pbToken);
 		chat = await resolveChatIdentity(session, pbToken);
+		// fams is superadmin-only (non-realtime). Fetched server-side for both
+		// roles; also recomputes + persists the derived `active` flag.
+		const res = await ensureFamAccess(famId).catch(() => null);
+		if (res) {
+			fam = res.fam;
+			famAccess = res.access;
+		}
 	}
 
 	return {
+		// Canonical fam slug — from the URL param ([fam] routes). Client code
+		// reads page.data.famSlug; never copy it into local $state.
+		famSlug: event.params.fam || '',
 		session: session
 			? {
 					famId: session.famId,
 					userId: session.id,
-					famSlug: event.params.fam,
 					memberName: session.name,
 					memberColor: session.color || '',
 					role: session.role
@@ -71,9 +83,7 @@ export async function load(event) {
 		famId,
 		chat,
 		pbToken,
-		// fams is superadmin-only (non-realtime). Fetched server-side for both roles.
-		fam: famId
-			? await pbAdmin.getOne('fams', famId).catch(() => null)
-			: null
+		fam,
+		famAccess
 	};
 }