feat: GitlabUser and GitlabUsers components

CLAUDE.md

@@ -45,8 +45,17 @@ static HTML. The browser never holds a token or calls the GitLab API.
   `require` export condition; `test/packaging.test.ts` guards this.
 - `pnpm test` — run all tests (Vitest). Use `pnpm exec vitest run <file>` for one file.
 - `pnpm run typecheck` — `tsc --noEmit`.
-
-There is no dev server. After code edits, run
+- **mise tasks** (`mise.toml`) mirror the pnpm scripts:
+  `mise run setup | lint | lint:fix | typecheck | test | build`, plus
+  `mise run release` (runs the full gate locally and shows the pending
+  release-please PR — never publishes) and example-site tasks that rebuild
+  `dist/` first: `gitlab:build`/`gitlab:start` (showcase site, live gitlab.com
+  data) and `site:build`/`site:start` (`examples/site` is the e2e fixture —
+  its stub projects 404 against real gitlab.com, so `site:build` only works
+  with `GITLAB_HOST` pointing at a stub; `site:start` renders Fallbacks in dev).
+
+There is no dev server for the package itself (`mise run gitlab:start` serves
+the showcase site to see components live). After code edits, run
 `pnpm exec vitest run` and `pnpm run typecheck`. The e2e test
 (`test/e2e/build.test.ts`) builds a real Docusaurus site and is slow (~1 min);
 run it explicitly when touching the pipeline.

CONTRIBUTING.md

@@ -34,9 +34,20 @@ pnpm run build     # bundle the package into dist/
 | `pnpm run lint:fix` | Auto-fix lint issues |
 | `pnpm run build` | Compile with tsc (ESM-only + types) |
 
+All of these are also exposed as **mise tasks** (`mise tasks` to list):
+`mise run setup | lint | lint:fix | typecheck | test | build | release`.
+
 The example sites have their own READMEs:
 [`examples/site`](./examples/site/README.md) (mocked, drives the e2e) and
 [`examples/gitlab`](./examples/gitlab/README.md) (live gitlab.com data).
+They have mise tasks too — each rebuilds the plugin's `dist/` first:
+
+| Task | What it does |
+|---|---|
+| `mise run gitlab:build` / `gitlab:start` | Build / serve the showcase site (`examples/gitlab`, live gitlab.com data) |
+| `mise run site:build` / `site:start` | Build / serve the e2e fixture site (`examples/site`) — its stub projects 404 against real gitlab.com, so `site:build` needs `GITLAB_HOST` pointing at an instance that has them (the e2e test provides a stub); `site:start` works in dev (failed fetches render the Fallback) |
+
+Both sites read `GITLAB_TOKEN` / `GITLAB_HOST` from the environment.
 
 ## Conventions
 
@@ -80,6 +91,9 @@ and published to npm with provenance via OIDC trusted publishing.
    `publish` job runs `npm publish --provenance --access public`. No npm token is
    stored — publishing authenticates via GitHub OIDC.
 
+`mise run release` runs the full gate locally (frozen install, lint, typecheck,
+test, build) and then shows the pending release PR — it never publishes.
+
 ### One-time setup
 
 - On npmjs.com, add `ebuildy/docusaurus-plugin-gitlab` +

README.md

@@ -261,6 +261,46 @@ Both components render [scoped labels/topics](https://docs.gitlab.com/ee/user/pr
 (`scope::value`, e.g. `Abilities::Performance`) as a two-part badge — the scope keeps its
 color and the value gets a dark-gray background. The split is on the last `::`.
 
+### `<GitlabUser>`
+
+A user profile as a small card: photo, display name, linked `@username`, and
+configurable profile sections from the public user API.
+
+```mdx
+<GitlabUser name="jdoe" />
+
+<GitlabUser name="jdoe" show="org,bio,counts" />
+```
+
+| Prop | Type | Default | Description |
+|---|---|---|---|
+| `name` | string | required | GitLab username |
+| `show` | string | `org,location,bio,counts,since` | Card sections: `org`, `location`, `bio`, `counts` (followers/following), `since` (member since) |
+
+### `<GitlabUsers>`
+
+The members of a group **or** project (inherited included) as a grid of user cards.
+
+```mdx
+<GitlabUsers group="my-group" role="developer" />
+
+<GitlabUsers project="group/repo" show="role,org,counts" cardColumns={3} gap="1rem" />
+```
+
+| Prop | Type | Default | Description |
+|---|---|---|---|
+| `group` | string \| number | — | Provide either `group` or `project` |
+| `project` | string \| number | — | Provide either `group` or `project` |
+| `role` | string | — | Exact-match filter: `guest`, `reporter`, `developer`, `maintainer`, `owner`, … |
+| `show` | string | `role` | `<GitlabUser>` tokens plus `role` (role badge) |
+| `limit` | number | all | Max members to show (fetch capped at 500) |
+
+The grid accepts the shared card-grid props: `cardColumns`, `cardMinWidth`
+(default `260px`), `gap`, `maxWidth`, `align`. The default `show="role"` costs a
+single members call; profile tokens add one cached profile lookup per member at
+build time (two API requests per member on a cold build, deduplicated across
+pages and builds).
+
 ### `<GitlabRoadmap>`
 
 Renders a timeline of GitLab **epics** (Premium/Ultimate, group-level) or