[DebelToni]

Implements the Overroot consumer of accounts.toni.foo using authorization code + S256 PKCE, confidential exchange, host-only HttpOnly cookies, per-request grant introspection and bounded WebSocket revalidation. Keeps project-scoped agent credentials independent and preserves local user IDs and permissions through explicit operator mappings. Retires local password endpoints and adds migration/security tests. Draft intentionally: provider, private runtime configuration, Paperview compatibility and verified stopped-service migration must be ready before owner-session review/merge and coordinated activation. No installed updater, unit, workflow, dependency or review-policy changes.

[DebelToni]

Owner-session review complete for this exact revision: PKCE/state and confidential exchange, Host/Origin/cookie boundaries, explicit identity mapping and recovery checks, private memberships/non-elevation, independent agent auth, provider-outage behavior and bounded socket revocation reviewed. Hosted CI and CodeQL pass, including real Docker compiler test. The first CI run exposed an incomplete dashboard test transport mock; corrected in this reviewed head and fresh CI passed. No candidate application/test/build/install execution on DGX. No dependency, workflow, installed updater or review-policy changes. Anton explicitly approved coordinated cutover and private service configuration; deployment and backup timers are held. Space provider passed 514 tests and Paperview 65 tests, with native installation explicitly deferred by Anton. Merge is source admission only; migration and activation verification remain gated.