Mira brings scoped specialists and private channels to AI Studio

AI Studio now gives every venue one general assistant, Mira, plus versioned
specialists that can be published for focused work. Owners can grant access by
staff role or individual user, then restrict each grant to selected brands,
locations, data areas, and actions. A staff member only sees the assistants and
records their grant allows. The separate `ai.conversations.use` permission lets
owners allow chat without also granting conversation export or deletion.

Mira is available for direct chat. She can also delegate a task to one
published specialist and return the result in the same conversation. A
specialist can be opened directly when granted, but specialists cannot hand
work to other specialists. The builder includes editable starting points for
Promotions & Partnerships, Operations & Scheduling, Client Success &
Retention, and Finance & Performance. Each starts with a curated, bounded set
of venue tools instead of broad access, and remains editable for mission,
personality, venue scope, staff grants, and Mira's management rights.

Owners can also ask the Promotions & Partnerships specialist to watch booking,
purchase, and promotion patterns on a daily or weekly schedule. Each schedule
has one staff owner and one exact access grant. Before each provider call it
rechecks the owner's active membership and normal AI permission, the current
published specialist, Mira's delegation right, the grant and its brand/location
scope, and the specialist budget. Completed reports and visible failures appear
in that owner's report inbox. Scheduled work is read-only: it can recommend
next steps, but it cannot send or change anything in the background.

Writes remain human-controlled. AI Studio shows a durable pending confirmation
before a write, records what was approved, and provides an activity and undo
view when an action is reversible. Mira and specialists can suggest learned
venue guidance, but it becomes active only after an authorised person reviews
and approves it. The activity record makes the action, confirmation, result,
and undo or irreversible status visible.

Brand-scoped promotion work is also enforced at the final campaign boundary:
an assistant cannot attach another brand's offer or explicit client list to a
draft, and the same scope is checked again before a person sends it. Deleting a
conversation or reaching the venue's retention window removes its separate
Mira-to-specialist copies as well, so delegated prompts and reports do not
become hidden history.

### Connect a mailbox

From **AI Studio → Channels & connections**, an owner or administrator can
connect Google Workspace, Microsoft 365, or an IMAP/SMTP mailbox. Choose the
smallest useful capability:

- **Metadata** — identify messages and basic headers, without body previews.
- **Read** — read message content.
- **Draft** — create drafts, but do not send.
- **Confirmed send** — send only after the normal human confirmation.

Mailbox access can be granted separately to Mira and each specialist, and the
mailbox brand/location scope must fit the specialist scope. Disconnecting a
mailbox removes its usable credentials and assistant grants; reconnecting
requires a fresh access assignment. Email content is treated as untrusted
information, not instructions.

### Telegram

In **AI Studio → Channels & connections**, an authorised administrator can
choose a staff member and create a private one-time Telegram link. Staff with
`ai.conversations.use` can also create their own private link from the staff AI
Assistant. Open it within ten minutes; it is bound to the selected active venue
membership and cannot be reused. The linked account can use Mira or a published
specialist that staff member is allowed to use. Text works without speech;
inbound transcription and outbound voice replies are optional per account and
remain venue-controlled capabilities. Voice files are size-limited, processed
temporarily, and are not saved as venue data. Outbound voice replies are labeled
as AI-generated.

The Telegram bot is platform-managed, so venues never paste bot tokens into
their settings. If speech is not enabled by the platform, Telegram continues
to work as text-only chat.

### Owner setup checklist

Before inviting staff to use AI Studio:

1. Publish specialists, assign role/user grants, and review every brand and
   location scope before inviting staff to chat. Configure Mira's per-specialist
   management level and rights; model/provider routing remains platform-managed.
2. Connect only the mailboxes and Telegram accounts the venue needs, starting
   with the smallest useful capability.
3. Verify a read-only chat, a delegated specialist result, a promotion/partner
   draft, a scheduled read-only watch and owner report, a confirmation-required
   write, a reviewed learning proposal, and an undo ticket. Confirm mailbox and
   Telegram disconnect/revoke paths.

The first release intentionally has a clear limit: writes always require a
human confirmation. Any unattended automation request is routed to review;
there is no silent background write path.