feat(nav): global ⌘K command palette

Adds a global command launcher reachable from anywhere via ⌘K (Mac) /
Ctrl+K (Win), or "/" when no input is focused.  Three sections:

- **Navigation** — every primary route from the top-bar nav, plus the
  full Admin sub-menu, role-gated against the session.
- **Recent activity** — last 5 audits and last 5 device observations,
  lazy-loaded once on first open from /api/dashboard/overview.
- **Companies** — fuzzy search against the active customer list from
  /api/companies, kicks in once the user types 2+ characters.
  Selecting a company deep-links to /configuration-items?company=<id>.

Top-bar exposes a small "Search · ⌘K" pill on md+ for discoverability,
sized to fit between the Status indicator and the Theme toggle.

Implementation:
- shadcn `command` primitive (uses cmdk under the hood); declined the
  bundled dialog overwrite to keep our existing dialog.tsx.
- CommandPalette mounted once in app/layout.tsx so it lives outside the
  AppNavigation re-renders.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DESIGN.md

@@ -349,6 +349,15 @@ below is the working backlog; expand as we go.
       expandable-row patterns (useful for `/veeam-analysis`-style
       drill-downs).
 
+### Command palette (2026-05-03)
+- [x] **Cmd+K / Ctrl+K** opens a global launcher
+      (`components/navigation/command-palette.tsx`). Three sections:
+      Navigation (every primary route, role-gated), Recent activity
+      (last 5 audits + 5 observations from `/api/dashboard/overview`),
+      Companies (filtered client-side from `/api/companies`). The `/`
+      key also opens it when no input is focused. Top-bar shows a small
+      "Search · ⌘K" button (md+) for discoverability.
+
 ### Status & dashboard split (2026-05-03)
 - [x] Move integration health + sync health off `/dashboard` onto a
       dedicated `/status` route. Top-bar `<StatusIndicator />` links there.