feat(auth): distinct auth_anthropic_exchange step (2-step OAuth, opt-…

…in) (#61)

Consolidates the orchestrator's bespoke Anthropic oauth_exchange (deleted
in agent PR5) into auth as a DISTINCT step — separate from the generic
auth_oauth_exchange (google/facebook). Owns proto messages + codegen +
2-step handler (code->token at console.anthropic.com, token->API-key at
api.anthropic.com; PKCE state-as-verifier quirk). Gated enable_anthropic_oauth
default false (D17 confused-deputy: mints long-lived Anthropic API keys).
Wired into the in-process EnginePlugin entry (PR1) for ratchet. gRPC path
unchanged. Proto codegen command recorded.

Co-authored-by: Claude <noreply@anthropic.com>

fix(adminidentity): persist visible 2FA state (#59)

* fix(adminidentity): persist visible 2FA state

* fix(adminidentity): disable caching for JSON responses

fix(adminidentity): infer TOTP enrollment from credentials

Use `totp_enrolled` as the authoritative explicit state when present, and fall back to scanning returned credentials only for older/compatible hosts that omit the field.

Verification:
- GOWORK=off go test ./adminidentity -run TestHandlerServesIdentityPageWithConfiguredRoutes -count=1
- GOWORK=off go test ./...
- wfctl plugin validate-contract --for-publish --tag v0.3.13 .

Complete reusable identity admin workflows (#57)

* fix: complete identity admin workflows

* fix: include recovery email in identity user

* fix: restore passkey enrollment UI

* fix: expose totp enrolled ui state

* fix: report identity credential methods

* fix: preserve credential creation status

* fix: address identity admin review

feat: add reusable auth identity admin surface (#56)

* feat: add reusable auth identity admin surface

* fix: address identity admin review feedback

docs(auth): audit production followups (#55)

* docs(auth): audit production followups

* docs(auth): address review notes

feat: add auth admin config UI

Add a reusable auth admin configuration UI handler for host applications.

workflow-plugin-auth v0.3.7