Project creatortrack fin connect p0 p3 done

All four phases (P0-P3) of multi-tenant FIN Connect are built, verified (webpack clean, RLS isolation proven: non-member sees 0 rows), and committed on branch feat/fin-connect-p0 (7 commits ahead of main). NOT merged, NOT deployed. Each workspace user can now connect their own SimpleFIN bank via a pasted setup token instead of relying on Justin's global secret; RLS scopes each user to their own finance data; Finances gate flipped from owner-email check to per-workspace financeAccessAllowed policy in lib/finance-access.ts.

To go live: (1) merge branch + deploy (runs 3 migrations), (2) run scripts/fin-connect-adopt-global-url.mts 67 on prod to migrate Justin's global SimpleFIN URL into a #67 connection, (3) cleanup commit to delete the global-secret fallback and legacy connect route passphrase (deliberately kept until deploy to avoid breaking Justin's sync).

There are now two unmerged finance branches waiting on Justin's go-ahead: feat/finances-shared-krystal (Krystal sharing) and feat/fin-connect-p0 (this).

Why: Enables strangers/other CreatorTrack users to use Finances without Justin's bank credentials or platform cost (BYO key model). How to apply: Before touching CreatorTrack finance code, check if this branch has been merged yet; if not, RLS/gate behavior on main still reflects the pre-P3 owner-only model. Reference doc: CT multi-tenant FIN connect.

[auto-memory session 86183751-1c8f-47ba-bcc8-7ed0bdf2ed40, confidence 0.90, mode direct]