Merge authoritative main into the task branch

Why: include the current integration baseline before verification.

Evidence: fetched origin/main=ed3847c85ce111a74f0cb100908abfb40f62db07.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync

.task/archive/final-cleanup-summary.md

@@ -28,7 +28,7 @@
 - `/api/admin/roles POST {"name":"developer"}` → `roleId: role_c106b6490383`
 - `/api/admin/users/bob/role PUT {"roleId":"role_xxx"}` → 200 OK
 - `/api/capability/explain` for admin → full `CapabilityExplain` DTO（U3A 输出）：
-  ```json
+  ```
   {
     "projectCreate": {allowed:true, source:"bootstrap-admin", linkedActions:[4 actions]},
     "memberBasicCollaborate": {4 actions, all "role-unassigned" for non-admin},