major fixes

apps/api/internal/httpapi/auth_handlers.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/descrybe/descrybe-v2/apps/api/internal/auth"
+	"github.com/descrybe/descrybe-v2/apps/api/internal/billing"
 	"github.com/google/uuid"
 )
 
@@ -359,6 +360,17 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 		if credits, err := s.Billing.CreditsOverview(r.Context(), cid, s.Config.LowCreditsThreshold); err == nil {
+			// /me seeds the dashboard capability matrix before /billing/capabilities
+			// lands, so the per-member overlay must be applied here too — otherwise a
+			// restricted member sees a flash of the full nav on every page load.
+			if perms, perr := s.Billing.MemberPermissions(r.Context(), cid, uid); perr == nil && len(perms) > 0 {
+				features, denied := billing.ApplyMemberPermissions(credits.Features, perms)
+				credits.Features = features
+				credits.DisabledFeatures = append(credits.DisabledFeatures, denied...)
+				credits.FeatureETag = billing.FeatureETag(features)
+				credits.MemberRestricted = true
+				credits.MemberDeniedFeatures = denied
+			}
 			out["credits"] = credits
 		}
 		if m, err := s.Auth.EnsureMembership(r.Context(), uid, cid); err == nil {