feat(platform-objects): lock studio & account apps with ADR-0010 full protection

Studio and Account shipped without a protection block, so tenant
overlay writes to PUT /api/v1/meta/app/{studio,account} succeeded —
the NavigationSyncEffect bug in objectui demonstrated the hazard by
writing auto-navigation into these system apps. Both are core platform
UI in the same class as Setup (which already carries lock: 'full'):

- studio: the metadata workbench — a broken overlay locks implementers
  out of the very surface used to repair metadata
- account: every authenticated user's only self-service security
  surface (sessions / API keys / linked accounts)

The loader translates protection into the _lock envelope; objectui's
isNavigationSyncableApp already filters on _lock ∈ {full, no-overlay},
so client behavior is automatically correct. Setup-style navigation
contributions are unaffected (registration-time in-memory merge, not
overlay writes).

Adds a regression test pinning lock: 'full' on all three platform apps.

Verified end-to-end on a rebuilt showcase stack: GET /api/v1/meta/app
now serves _lock: "full" for setup, studio, and account.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

packages/platform-objects/src/apps/account.app.ts

@@ -38,6 +38,16 @@ export const ACCOUNT_APP: App = {
   isDefault: false,
   // Surface via the avatar dropdown, not the App Switcher — see App.hidden.
   hidden: true,
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time. Every
+  // authenticated user depends on this app to manage their own
+  // sessions / API keys / linked accounts, so a tenant overlay that
+  // breaks it is a security-relevant outage — same class as Setup.
+  protection: {
+    lock: 'full',
+    reason: 'Core self-service security UI shipped by @objectstack/platform-objects — see ADR-0010.',
+    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+  },
   branding: {
     primaryColor: '#0ea5e9', // sky-500 — distinct from Setup's slate
   },

packages/platform-objects/src/apps/studio.app.ts

@@ -34,6 +34,15 @@ export const STUDIO_APP: App = {
   icon: 'hammer',
   active: true,
   isDefault: false,
+  // ADR-0010 §3.7 — author-facing protection block. Loader translates
+  // this into the `_lock` envelope at registration time. Same rationale
+  // as Setup: tenant overlay edits to the metadata workbench can lock
+  // implementers out of the very surface used to repair metadata.
+  protection: {
+    lock: 'full',
+    reason: 'Core developer workbench shipped by @objectstack/platform-objects — see ADR-0010.',
+    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+  },
   // Studio is the metadata-authoring host, so its ambient copilot is
   // pinned to the schema-architect agent. Resolved by the ambient chat
   // endpoint via `app.defaultAgent` — no UI-side `?agent=` override

packages/platform-objects/src/platform-objects.test.ts

@@ -28,7 +28,7 @@ import {
   SysMetadataHistoryObject,
 } from './metadata/index.js';
 import { SysSetting } from './system/index.js';
-import { SETUP_APP, SETUP_NAV_CONTRIBUTIONS } from './apps/index.js';
+import { ACCOUNT_APP, SETUP_APP, SETUP_NAV_CONTRIBUTIONS, STUDIO_APP } from './apps/index.js';
 import { AppSchema } from '@objectstack/spec/ui';
 
 const systemObjects = [
@@ -156,6 +156,24 @@ describe('@objectstack/platform-objects', () => {
     });
   });
 
+  describe('platform app protection (ADR-0010 §3.7)', () => {
+    // All three platform apps are core UI shipped by this package: a
+    // tenant overlay that breaks Setup/Studio locks admins/implementers
+    // out of the repair surface, and Account is every user's only
+    // self-service security surface. The loader translates `protection`
+    // into the `_lock` envelope; clients (e.g. objectui's
+    // isNavigationSyncableApp) rely on `_lock` to skip automatic
+    // navigation writes into these apps.
+    it.each([
+      ['SETUP_APP', SETUP_APP],
+      ['STUDIO_APP', STUDIO_APP],
+      ['ACCOUNT_APP', ACCOUNT_APP],
+    ])('%s declares a full lock', (_name, app) => {
+      expect(app.protection?.lock).toBe('full');
+      expect(() => AppSchema.parse(app)).not.toThrow();
+    });
+  });
+
   describe('SETUP_NAV_CONTRIBUTIONS (ADR-0029 D7)', () => {
     const shellGroupIds = new Set(
       (SETUP_APP.navigation ?? []).map((n) => n.id),