T1-8 — Worker Fact-Authoring UI: Asset/Expense + Member Editors + #632 Gate (#676)

services/canopy-web/src/api/{assets,expenses}.rs (new; add mod assets; mod expenses; to api/mod.rs), mirroring income.rs: Add{Asset,Expense}Form
Edit{Asset,Expense}Form (edit carries the full value + window as hidden carriers, like EditIncomeForm) + a hidden program + target_section; {asset,expense}_claim_body(…​) building the serde_json::json! body (value.{asset_type,value,description} / value.{expense_type,amount,frequency}, source:"self_attestation", author:{author_type:"worker",sub}, origin:"worker_portal", valid_from, valid_to, fact_id); add_* + edit_* handlers POSTing /v1/persons/{id}/{assets,expenses}/claims. No remove_* (close → #562; leave a // #562 marker). Handlers return axum::response::Response: gate before the persons call — deny → (FORBIDDEN, render_program_scope_denied_case(&form.program, &form.household_id)); success → Redirect to /cases/{hh}?program={prog}&focus_section={fs}&notice=eligibility-changed (reuse safe_focus_section); error → (UNPROCESSABLE_ENTITY, Html(…​)). Routes after api/mod.rs:159: /actions/{asset,expense}/{add,edit}. Separate form DTOs
separate tab_{assets,expenses}.html (no IEVS/variance/employer_name).

Add in_program_scope(&form.program) + the 403 deny to the existing income.rs add_income/edit_income/remove_income (change their return type to Response to emit a real 403); add a hidden program field to the tab_income.html editor forms + a program_slug field to TabIncomeTemplate and every construction site
test fixture; carry program in income’s success redirect (income.rs:157).

render_{assets,expenses}_tab in case_detail.rs (mirror render_income_tab minus the SNAP-IEVS merge): read GET /v1/households/{id}/full, parse m["assets"] / m["expenses"] into new AssetRecord / ExpenseRecord read DTOs in clients.rs (mirror IncomeRecord) that carry the provenance fields (claim_status + author kind), build Asset/ExpenseRow for new templates/cases/tab_{assets,expenses}.html (current-facts table with a provenance/status indicator mirroring income’s "verified" badge; add form; per-row edit form with hidden carriers; no variance column, no remove button). Factor each member-loop body into a build_{asset,expense}_row() helper so each render_*_tab stays ≤100 lines (B2) / ideally ≤40 (clippy). Wire sections/{assets,expenses}.rs fetch(clients, household_id, session, program, csrf_token, item) (mirror sections/income.rs) + the dispatch_fetch arms (sections.rs:261-262). The stub modules already carry #[canopy_plugin] + Plugin.toml — change only the fetch signature + the dispatch arm.

Integration: a worker asset + expense authored via the editor handler lands an AcceptedVerified worker-authored version and appears in GET /v1/households/{id}/full, and the rendered tab shows the provenance; a 403 #632 gate test on an out-of-scope-program write (mirror put_section_proxy’s 403). E2E: a Playwright spec (mirror `tests/e2e/specs/fact-history.spec.ts) opening the Assets/Expenses sections, adding a fact, asserting it renders (dark-theme check).

Antora api/canopy-web.adoc (new /actions/{asset,expense}/ routes + the #632 gate on all fact writes + the 403 deny); this plan’s MR1 Status cells → Done (YYYY-MM-DD) — <sha>; CHANGELOG.adoc == Unreleased *Added entry; master-plan T1-8 row → In progress.

services/canopy-web/src/api/members.rs (new; add mod members;): forms carry the hidden program + target_section; AuthenticatedWorker + WritePermission
in_program_scope(&form.program); return Response with the 403 deny pattern.

render_persons_tab in case_detail.rs reads GET /v1/households/{id} → HouseholdWithMembers (members carry id + relationship + effective_date — the only source with the member id) for the member list / remove + edit-demographics forms; templates/cases/tab_persons.html; wire sections/persons.rs fetch(…​) + the dispatch_fetch arm (sections.rs:260). The persons section is the member editor; render_household_tab stays the read-only summary.

Integration: add member (→ membership reflects it), edit demographics (COALESCE-aware — an omitted field is preserved), remove member (→ gone); a 403 gate test; an assertion that SSN never appears in logs for the add/edit path. E2E: add a member via the persons editor, assert it appears.

Antora api/canopy-web.adoc (member routes); this plan Status → Done + an As-built note (the descopes, ADR-027 §5 Track-2 grounding, relationship-immutable, SSN exclusion); master-plan T1-8 row → Done (YYYY-MM-DD) — <sha> + reconcile its description (drop "policy-aware PUT" + "Proposed-claim inbox"; note the Track-2 / T1-9 re-slice); CHANGELOG Added entry. No .claude/CLAUDE.md change (only the final MR of the epic flips its status tables; T1-8 is not the last epic unit).