preserve: store conformance + db provisioning + self-hosted IdP WIP off station01 (draft, not for merge)

[andrei-hasna]

What this is

A preservation snapshot, not a finished change. Draft on purpose.

This is the largest body of unpreserved work found on station01 — 384 files,
82,935 insertions, 7,624 deletions — and it was sitting uncommitted in a shared
checkout that a live agent was using, with the machine's tmux code session queued for
retirement (todos a3d6e8e9).

Contents

area	size
src/store/conformance.ts	+2,193 — store conformance suite
src/db/provisioning.ts + .test.ts	+2,872
src/db/sandbox.ts + .test.ts	+1,854
src/db/aliases.test.ts	+1,416
src/mode-axis-ratchet.test.ts	+1,339
src/db/forwarding.test.ts	+1,140
src/db/owners.ts	+1,052
src/db/emails.test.ts	+1,052
src/test-support/v1-store-api.ts	+1,035 (new)
src/store-http.test.ts	+978 (new)
src/store-sqlite/messages.ts	+847
src/server/self-hosted/auth/**	self-hosted IdP token, JWKS revocation, multi-grant, store
docs/AUTHENTICATION.md, docs/CLI.md	new

How it was taken without disturbing the agent

Built from the working tree through an isolated index (GIT_INDEX_FILE +
write-tree + commit-tree). Nothing in the checkout was touched:

HEAD, branch and working-tree status : identical
.git/index md5 before                : 956120a96f558b26e70e67c13c719d9e
.git/index md5 after                 : 956120a96f558b26e70e67c13c719d9e

Base drift, stated plainly

The checkout sits at 6646cc8c, an ancestor of main. This branch is cut from a
base that has since moved; the diff will show that drift alongside the real change.

Secrets — scanned harder than usual, because of the size

• Mandated staged scan over the full 103,239-line working-tree diff and every
  untracked file: 0 hits. Positive control 2, negative control 0.
• Paths matching env|secret|credential|token|pem|key|npmrc|auth were enumerated by
  hand: 15 matches, all of them source and docs for auth features — IdP token
  handling, a provider-secrets module, docs/AUTHENTICATION.md. No credential files,
  no .env, no .pem, no .npmrc. Positive control on that path grep: 181 matches
  for test.
• The regex scan has a known structural blind spot — a bare high-entropy value with no
  recognisable prefix. So added lines in *.json|toml|yaml|yml|env* were read
  individually: 6 candidate lines, all benign ("authMode": "api-key",
  "authMode": "local-only", "apiKeyAppAliases": [, and a secrets:staged npm script
  entry). No values.

What this PR is NOT

Not reviewed, not tested, not ready to merge. No test run was performed and 82k lines
is far past what one review pass can absorb. Its author should split it before anything
lands.

The purpose here is narrow: this change existed on exactly one disk, and it now exists
somewhere else too.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}