feat: add delegated credential lifecycle and private storage

[donmasakayan]

Summary

Add tenant-scoped delegated credential grants, proof challenges, audit and notification records, immutable scope snapshots, expiry, verified targets, and retained revocation tombstones. Issued secret material remains hashed and private while machine identity is kept separate from human consent.

This targets v2 following the backlog invitation to resubmit, after the prior closed #1610/#1948.

Verification

All verification below was run locally from the final frozen stack; no public CI run is claimed.

• bun run format:check — 2,226 files, exit 0.
• bun run lint — 1,933 files, zero warnings or errors, including the changeset stub check.
• bun run typecheck — 45/45 tasks, exit 0.
• bun run test — 39/39 workspace tasks; 4,633 tests passed, 45 conditional skips, zero failures.
• e2e — local self-host scenarios delegated-credentials-a-member-key-keeps-an-approved-emulator-connection-scoped- and delegated-credentials-selfhost-issues-masks-and-revokes-a-local-key passed 2 applicable cases with issuance enabled; the default issuance-disabled case also passed. Local trace-redaction coverage passed 3/3. Recordings and traces are retained locally and are not publicly linked.

Live IdP and Cloudflare Access login flows were not exercised; coverage for those flows is limited to unit/integration tests.

Checklist

• Added a changeset, or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

Stack

• #2322 — delegated credential lifecycle and private storage.
• #2323 — delegated scope enforcement across execution and sessions.
• #2324 — delegated credentials across hosted adapters.
• #2325 — delegated credential account controls.
• #2326 — delegated credential documentation and local rollout verification.