feat(pam): unified vault-row access-state badge

[Hinton]

🎟️ Tracking

Implements the "Unifying access-state badges consistently across vault, modal, and Requests page" spec (Figma 88-1699) for the vault-row surface.

📔 Objective

Replace the two-state, icon-only vault-row lease badge with the unified access-state badge from the spec: a bit-badge pill with per-state colour + icon + copy, mutually exclusive precedence, and the 5-minute danger "Ending soon" escalation. The recipe lives in a reusable AccessStateBadgeComponent so the cipher-view modal and Requests page can adopt the identical recipe in follow-ups.

State model

State	Variant	Icon	Copy
Privileged (resting, gated)	primary	bwi-key	"Privileged"
Pending	warning	bwi-clock	"Pending approval"
Ready to use (approved, not activated)	success	bwi-check	"Ready to use"
Active lease > 5m	accent-primary	bwi-unlock	"18m left"
Active lease ≤ 5m	danger	bwi-exclamation-triangle	"Ending soon • 4m left"
Session ended (expired)	subtle	bwi-lock	"Session ended"
Unavailable (held by another)	subtle	bwi-lock	"Unavailable" — modelled, not yet produced (see Deferred)

Precedence (highest-ranked true state wins): active lease → ready → pending → privileged.

What's here

• access-state-badge/ — AccessStateBadgeComponent + cipherAccessBadgeState resolver + specs.
• vault-row-lease-badge/ — the VAULT_ROW_LEASE_BADGE provider, rewritten to render the shared badge.
• AccessRequestSdkService.getCipherAccessState (binds commercial().pam().access_requests().cipher_access_state).
• provide-pam binds VAULT_ROW_LEASE_BADGE; 7 pamAccessBadge* i18n keys.

Deferred

"Unavailable / held by another user" is modelled in AccessBadgeState and the recipe but not yet produced by the resolver: CipherAccessStateView is caller-scoped and never reports another user's lease. Lighting it up needs a new signal on the SDK CipherAccessStateView fed by the server access-state query.

⚠️ Draft — stacked, CI red on inherited base drift

Stacks on #22171 (the VAULT_ROW_LEASE_BADGE seam token) + #22147 (the PAM SDK request services). The PR base is an integration branch (pam/vault-row-access-badge-base = main + #22171 + #22147) so the diff shows only the badge. Retarget once the team settles the stack.

CI is red on 20 pre-existing errors inherited from the base PRs — none in the badge code:

• feat(vault): route PAM gated ciphers through the SDK (partial-cipher pivot) #22171 reads partial / partialData, which are absent from the published @bitwarden/sdk-internal@0.2.0-main.956 and need the still-unpublished sdk-internal Trying to get the status code. #1359.
• feat(pam): add "My access" page for leasing requests and leases #22147 predates the SDK AccessDecider union refactor (deciderKind / name / email no longer exist on AccessRequestDecisionView).

The badge's own files are clean — ESLint + prettier pass, 29 unit tests pass, and the badge logic typechecks (its only build error is the inherited cipher.partial). This goes green once #1359 publishes and the base PRs adopt their drift fixes.

Verification

• jest over access-state-badge, vault-row-lease-badge, access-requests-sdk.service → 29 passed.
• lint-staged (ESLint + prettier) clean on all 13 changed files.