The terminal's People screen suspends or unsuspends an account with `s` and a confirm, as MCP `account_suspend` does #7274

On the terminal's People screen, s now suspends or lifts an account after a confirm, using the same actions MCP account_suspend calls. The new test/tui-people-suspend.test.ts passes, along with test/roles.test.ts, test/people-timing.test.ts and test/mcp-size.test.ts. tsc and design-lint are clean. I did not run scripts/fast.ts or the full suite, so the forge's check on this push is the first full run.

• Rows: a suspended account's row now ends with suspended YYYY-MM-DD. To show it, listPeople in src/core/roles.ts now returns suspendedAt on each person.
• Suspend: s asks for the account name, then a confirm says the person's sessions and tokens stop at once. Confirming calls suspendAccount. If the account is already suspended, the confirm instead says the person can sign in again with a new session, and confirming calls unsuspendAccount. The confirm starts on Cancel.
• Refusals: yourself, another admin and an agent get ADMIN_WORDS.selfSuspend. The only owner of an organization gets lastOwnerSays. Nothing changes, and the words appear as a toast.
• Tests: esc at the confirm changes nothing. A confirmed suspend makes the person's session read as signed out and marks the row. A second s lifts it. Yourself, another admin and a sole org owner are each refused with MCP's words.

Left out:

• The screen has no row cursor, so s asks for an account name the way r does, rather than acting on a highlighted row. A cursor would be a larger change to the screen.
• I did not add a test for an agent target. Agents don't appear in the People list, so the name prompt reports "No such account, or not one a suspension is for." instead of the MCP words. The action's own selfSuspend refusal for agents is unchanged.

To try it, open the palette with ctrl+k, choose People, press s, type an account name and choose Suspend or Lift.

🤖 Generated with Claude Code

Closes #7267

On the terminal's People screen, s now suspends or lifts an account after a confirm, using the same actions MCP account_suspend calls. The new test/tui-people-suspend.test.ts passes, along with test/roles.test.ts, test/people-timing.test.ts and test/mcp-size.test.ts. tsc and design-lint are clean. I did not run scripts/fast.ts or the full suite, so the forge's check on this push is the first full run.

• Rows: a suspended account's row now ends with suspended YYYY-MM-DD. To show it, listPeople in src/core/roles.ts now returns suspendedAt on each person.
• Suspend: s asks for the account name, then a confirm says the person's sessions and tokens stop at once. Confirming calls suspendAccount. If the account is already suspended, the confirm instead says the person can sign in again with a new session, and confirming calls unsuspendAccount. The confirm starts on Cancel.
• Refusals: yourself, another admin and an agent get ADMIN_WORDS.selfSuspend. The only owner of an organization gets lastOwnerSays. Nothing changes, and the words appear as a toast.
• Tests: esc at the confirm changes nothing. A confirmed suspend makes the person's session read as signed out and marks the row. A second s lifts it. Yourself, another admin and a sole org owner are each refused with MCP's words.

Left out:

• The screen has no row cursor, so s asks for an account name the way r does, rather than acting on a highlighted row. A cursor would be a larger change to the screen.
• I did not add a test for an agent target. Agents don't appear in the People list, so the name prompt reports "No such account, or not one a suspension is for." instead of the MCP words. The action's own selfSuspend refusal for agents is unchanged.

To try it, open the palette with ctrl+k, choose People, press s, type an account name and choose Suspend or Lift.

🤖 Generated with Claude Code

All three of the smaller points and the README one are done and pushed; the one thing I did not do is add the terminal door to docs/MCP.md. tsc is clean, and test/tui-people-suspend.test.ts and test/mcp-size.test.ts pass (8 tests).

• Docs: the Roles paragraph in docs/CREW.md now covers s. It suspends or lifts an account by name after a confirm saying sessions and tokens stop at once. It follows the rules of account_suspend (not yourself, another admin or an agent, not the only owner of an organization). It also says a suspended row shows since when.
• Row helper: the row text now comes from a small rowOf helper in src/tui/screens/people.ts.
• Error mapping: not_allowed now maps to ADMIN_WORDS.selfSuspend explicitly. Any other error code shows "That did not work." instead of the wrong refusal.
• Non-admin test: a guest and a member each get no People command from the palette, so s opens nothing and nobody is suspended.

I left docs/MCP.md alone. Its account_suspend row is the MCP tool's own description, which test/mcp-size.test.ts measures against a ceiling, and the terminal door is not part of that tool. The terminal door is documented in docs/CREW.md instead. If you still want a line there, I'd put it somewhere other than that table row.

The non-admin test covers the palette gate only. I did not build a People screen directly on a non-admin session to press s on it. The refusal in that case is requireForgeAdmin inside the action, which already has its own tests.