feat(positions): tabbed position modal, terminal slots staged into create

[windischb]

Fixes the two places where the Positions modal broke the admin Modal & Form Contract (Atlas engineering/modal-form-contract, AGREED 2026-07-24).

1. Tabs

Five stacked sections become four tabs — General / Terminals / Authorized users / Staffing sessions — the shape every comparable modal already uses (Group, User, Client, App, LoginProvider); only the small three-section modals (Scope, Realm) stack sections.

Per rule 5 the sessions tab is absent in create: staffing sessions are runtime records that cannot exist before the position. Since rule 1 warns that "a setting on another tab is as unfindable as one behind a toggle", each tab label carries a warning popover listing that tab's validation issues, so a disabled Save always has a visible cause. Section headings that merely repeated the new tab label were dropped.

2. A position is creatable as a whole

Terminal slots used to be edit-only — the create dialog said "Terminal slots can be set up after the position is created." Grants in the very same modal were already staged, which is rule 3 (same relationship → same behavior) broken inside one component.

Slots are now staged in create and committed by the single Save, exactly like the service account's initial credential:

• PositionCreateDto gains a Terminals list.
• The create endpoint validates the staged slots up front (terminal use must be enabled in this same save; display name required), then stages each slot's terminal-managed OAuth client via the existing StageCreateTerminalClient plus its TerminalEnrollment stream into the same Marten session that already holds the position and grant streams.
• One SaveChangesAsync commits everything. A rejected slot returns before that call, so there is no half-created position and no orphaned OAuth client.

Enrollment stays a later step on purpose — that is a ceremony on the device, not a setting.

Verification

• dotnet build clean · vue-tsc --build clean.
• dotnet test --filter ~Positions: 56/56 green, including two new tests: two staged slots come back as Pending with their managed clients linked to position and enrollment; a staged slot without terminal use returns 400 Terminal.TerminalPolicyDisabled and leaves neither position nor client behind.
• The full suite is left to CI: the local run was started before the machine slept overnight (314 min wall clock, 137 s CPU — it simply stood still) and was killed rather than resumed. No indication of a problem in the suite itself.
• The admin SPA sits behind a login, so the tabs were not clicked through in a browser; the layout change is covered by type-checking and review, the create round-trip by the two integration tests above.

docs/admin/positions.md was updated in step.

🤖 Generated with Claude Code