[donmasakayan]

Stacked on #2324 — review only the top commit (0903a69)

Summary

Add toolkit and connection selection, one-time key and external-proof handoff, rotation, revocation, verified-target administration, notifications, and audit review to account settings. Keep proof material in dialog-local memory and preserve explicit empty-connection denial.

This targets v2 following the backlog invitation to resubmit, after the prior closed #1610/#1948.

Verification

All verification below was run locally from the final frozen stack; no public CI run is claimed.

• bun run format:check — 2,226 files, exit 0.
• bun run lint — 1,933 files, zero warnings or errors, including the changeset stub check.
• bun run typecheck — 45/45 tasks, exit 0.
• bun run test — 39/39 workspace tasks; 4,633 tests passed, 45 conditional skips, zero failures.
• e2e — local self-host scenarios delegated-credentials-a-member-key-keeps-an-approved-emulator-connection-scoped- and delegated-credentials-selfhost-issues-masks-and-revokes-a-local-key exercised key creation, proof completion, final consent, scoped emulator invocation, and UI revocation; 2 applicable cases passed with issuance enabled and the default issuance-disabled case also passed. Local trace-redaction coverage passed 3/3. Recordings and traces are retained locally and are not publicly linked.

Live IdP and Cloudflare Access login flows were not exercised; coverage for those flows is limited to unit/integration tests.

Checklist

• Added a changeset, or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

Stack

• #2322 — delegated credential lifecycle and private storage.
• #2323 — delegated scope enforcement across execution and sessions.
• #2324 — delegated credentials across hosted adapters.
• #2325 — delegated credential account controls.
• #2326 — delegated credential documentation and local rollout verification.