Release prep v0.14.0: drop full-sync prune, review fixes, consent rule, one draft bar

[windischb]

Why

Pre-release review of everything between v0.13.0 (in production) and 0.14.0-beta.9 (#233–#241), followed by a click-through of the admin UI against a dev realm. This PR carries what both turned up, plus the decision to drop full-sync prune before it ships another release.

What changes

Full-sync prune is removed (feat(provisioning)!)

• ?prune=true is gone from every manifest route: control plane …/realms/{slug}/apply, data plane …/realm-config/plan|apply, and the draft plan/apply endpoints.
• The two-step confirmation the 0.14 betas carried goes with it: 409 Manifest.ConfirmationRequired, confirmation tokens, parked review drafts, PruneOnApply. None of it was ever in a release.
• An apply is an additive merge by id. Deleting is a staged deletion in a draft, and the plan shows it before the apply. That works the same from the admin UI and from a Management API client.
• The plan result drops its Prune field and the protected action.
• A service-account credential can't be deleted through the clients section. It leaves through its account's Credentials list, which is the only place the plan shows it.

Fixes found in the review

• Draft endpoints with a bearer token. They read the caller from NameIdentifier, which a Management API bearer doesn't carry, so every call returned 500. They now read sub first.
• Renaming in a draft. Staging matched the draft entry by natural key only, so a rename appended a second entry with the same id. Staging now matches by Id first.
• Pinned credential id. A service-account credential that had an Id in the manifest was issued under a random id. Applying the same file a second time then failed with ClientIdAlreadyExists.
• Dormant groups. A group with an empty BoundTo came out of export → apply bound to the system app, because the exporter wrote the empty list as absent and create treats absent as ['modgud']. Empty BoundTo, Capabilities and job Parameters now export as empty. This also removes the phantom (empty) → [] plan changes.
• One-time secret after apply. Applying from the staging bar on any page other than the workspace dropped the secret behind a toast. The bar now opens the workspace, which shows it.
• Service-account grid after apply. It stayed empty until a reload. The post-apply refresh didn't cover service accounts, jobs or the inbox policy, and the applier sent no ServiceAccount event. Both are fixed.

Consent for dynamic clients (fix(oauth))

• Since Consent that means it, and a way to end one OAuth authorization #236 every DCR and CIMD client re-prompted on every authorize.
• A remembered authorization now skips the consent screen when the client's identity is assured (RFC 8252 §8.6): the redirect is https on a real host (claude.ai), or the client is confidential (ChatGPT's private_key_jwt, confidential DCR).
• Public clients with a loopback or private-use redirect (Claude Code, VS Code, Zed) are still asked every time. Any local process can listen on a loopback port.

Draft / export UI (feat(ui))

• The staging bar is the only footer bar. It holds Discard (confirmed, available from any admin page), Park and Apply, and Apply is the only primary action. The draft name and its counters link to the review. On narrow windows Discard and Park move into a ⋯ menu.
• The export basket moves into a header chip.
• Confirmations name their action instead of "OK". The library's popconfirm arrow is never positioned and covers the title, so it is hidden (tracked upstream).
• Lists show the draft state as New / Changed / To be deleted.
• A refused staged deletion shows why, and offers "Undo the deletion".
• Drafts show local time.
• The selective export no longer shows [object Object] for group roles.
• About 20 missing German strings are added.

Contract changes (pre-1.0)

• ?prune=true is ignored. A script that still sends it gets an additive merge and no deletions.
• Exports write empty BoundTo, Capabilities and job Parameters as [] / {}.
• Public DCR/CIMD clients that redirect to loopback see the consent screen on every authorize.

The draft release notes for v0.14.0 have been updated with all of the above.

Verification

• Backend: 852/852 integration tests (the count matches --list-tests) and 1749/1749 unit tests.
• Each new test was run red without its fix and green with it: bearer drafts, rename by id, pinned credential id, consent https vs loopback, private_key_jwt, dormant-group round trip.
• Frontend: pnpm type-check, the production build and the docs build all pass.
• UI: a Playwright tour of the draft and export surface passes 13 checks, with no console errors. It covers discard from any page, the export chip, the disabled-apply reason, undoing a deletion, the narrow-window menu and the sidebar badge.
• UI: manual click-through against a dev realm. Groups (create, rename, protected and real deletion), service accounts with credentials, users, app settings, jobs and realm settings all behaved as expected, and the consent flow was checked in the browser.

🤖 Generated with Claude Code