fix(auth): isolate API keys to exact credentials and organizations - #7461

API-key authentication and management bind to the exact authenticated credential and explicit organization. Management requires fresh direct active owner/admin membership independent of credential-grant storage. Invalid presented Bearers return terminal 401; unavailable verification returns terminal 503. Strict identifiers and fixed-origin URL construction constrain provider access.

Create/revoke and new API-key widget delegation stop before provider mutation. Inventory remains buffered until post-read external and local authority checks pass. Local locks do not make WorkOS membership atomic; there is no mutation retry.

Exact composition:

• Head: 1e0116c28de9cbcf9e7f09b1dc7b83618f75ef91; tree: 0984916e228bf3d0b504a8f824854855044bae85.
• Sole parent / qualified main: 32f25d968b73c2bbabd68d7ed9fbf2dfd127eb4f, the verified fix(auth): hydrate primary authorization snapshots per request #7462 squash landing (tree 8bdd72b68c7e0e8d01240d57b0c7542137db5edb).
• Reconstructed only the child delta 3216b0d61dca45211f4a500a6508e3bdcd0b3113..2d96ea6e2d1bc32cd7533c4596daef4ef39f3e64; no historical fix(auth): hydrate primary authorization snapshots per request #7462 series was replayed. Original author/committer metadata and full commit message are preserved.
• The exact cherry-pick required two community-mirror conflict resolutions, combining main's principal-based admin protections with typed terminal caller-auth errors. The grant-free management projection carries forward main's terminal lifecycle markers and exact-one-primary rule, with focused regressions and fixture adaptations. This is a reviewed composition correction, not a pure replay.
• CI on the previous published head exposed four complete auth mocks missing the new management middleware export. Each now aliases its existing fixture auth function. Exhaustive audit of 1,124 test files and 108 auth mocks found no remaining affected consumer. The 32 prior changed blobs are preserved; this correction adds four one-line fixture changes.
• Independent reconstruction matches the full tree and every changed blob: 36 paths, +4342/-425. Main's bounded DB client, generic snapshot/lifecycle implementation, exact credential capture, terminal optional-auth behavior and admin protections remain intact. No migration, dependency, workflow or hook changes.

Local qualification on this exact tree:

• 1,221 focused auth/API-key/HTTP/containment and integration tests passed in 38 files, including all four corrected mocks and PostgreSQL authority/race coverage. Both production and test-aware typechecks and migration validation passed.
• Full integration in a newly created, migrated, verified-clean isolated database: 2,353 passed, one failed, eight existing skips. The sole failure is the unchanged webhook lifecycle case's 15,000ms timeout. Controlled scanner-idle repetitions reproduced it on exact main and candidate, two failures of three runs each, with unchanged exercised source/import behavior. All fixture/database-sensitive suites passed in the fresh database, including ledger 36/36 and registry-feed 10/10. Failed-run evidence is retained. This specific inherited local failure remains recorded; integration is not reported green and no remote CI requirement is waived. No timeout, test or skip was changed.
• Exactly one complete unmodified normal commit hook ran on all 36 staged paths through ordinary git commit: exit 0; 1,063 root tests in 71 files; 10,654 server tests in 641 files, 31 unchanged skips; all three loopback tests, repository guards and both typechecks passed. Qualification used isolated Node v24.21.0 with IPv6 loopback enabled and a successful connection probe from the start. No hook bypass or test exclusion was introduced.
• Dependency manifests/lockfiles match qualified main. Its Build recorded 15 inherited installation advisories (4 moderate, 11 high); this PR does not claim to remediate that inventory.
• Independent final security/composition review: zero blocking findings, bound to the exact base/head/tree and all 36 changed blobs.
• Fresh official CodeQL CLI 2.27.0 / JavaScript queries 2.4.5 compared conditional-authorization-bypass and request-forgery results against exact main: parent 17 + 3, candidate 13 + 2. All 15 retained normalized reported graphs are identical; zero candidate-specific new or changed graphs. Three retained registry findings are in byte-proven unchanged regions of a modified file. This targeted comparison does not claim global GHAS closure.
• Both qualifying scans used separately materialized Git object bytes, full tracked-blob checks before and after scanning, and independent extracted-source verification. The final comparison is bound to exact-source archives and SARIF/log hashes.

Residual limits: external changes after the last provider observation and unobservable change-and-revert transitions remain outside the observed-read contract. Already-issued widget tokens are not revoked by stopping new issuance. Mutation re-enablement needs a reviewed same-authority mechanism. Canonical organization discovery and later explicit-context work remain separate; this does not close the whole #6827 cross-surface criterion.

Main-targeted CI and review: All 32 current check runs and the IPR status passed on this exact head against the qualified main. Build and all test shards, repository CodeQL, repository security aggregate, managed Code Quality, migration checks and IPR are green. CI integration totals 2,354 passed with eight unchanged skips; the webhook file passed all 15 tests. Ready Ladon run executed Reviewer and Arbiter successfully on this exact head; native aao-secretariat APPROVED is bound to the same commit. The single identified Draft-only Ladon skip was superseded by Ready success. Zero unresolved threads and CLEAN mergeability; synthetic merge 5d23e7ed0fb2bd0fee3f62765a61438a25a6df7b has parents qualified main + this head and exactly the reviewed tree. These gates are rechecked immediately before the guarded squash merge.

Required order remains #7462 → #7461 → later dependencies. Auto-merge is off. Merge requires all fresh exact-head checks green, executed Ladon Reviewer/Arbiter and native aao-secretariat APPROVED, zero unresolved threads, CLEAN mergeability, and a synthetic merge tree equal to the reviewed tree.