fix(auth-files): fence credential mutations by canonical identity

[seakee]

Summary

Fence auth-file mutations with canonical credential identity across the
Manager Server and frontend. This prevents stale or shared physical-file
identities from applying status, delete, inspection, or cooldown actions to
the wrong credential.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling

Changes

• Persist per-credential identity for inspection ownership, quota cooldowns, and account-action candidates.
• Serialize physical auth-file mutations and verify status/delete targets before execution.
• Fence frontend mutations and asynchronous responses by connection generation and canonical identity.
• Handle shared source files, ambiguous plugin-backed mutations, rollback compensation, quota identity, and localized diagnostics.

User Impact

Status changes, deletion, cooldown recovery, and inspection actions now fail
closed when the current credential identity is stale or ambiguous instead of
risking another credential in the same physical file. Users may see new
localized conflict or retry messages. No configuration changes are required.

Compatibility / Runtime Notes

• CPA panel mode: Mutation requests verify runtime and physical-file identity before applying changes.
• Manager Server mode: A shared coordinator serializes mutations affecting the same physical auth file.
• Full Docker / native packages: SQLite migrations run automatically when the Manager Server opens its database.

Data / Security Notes

SQLite migrations add credential identity fields and replace filename-only
ownership/cooldown uniqueness with per-credential keys. No credential bodies,
management keys, or secrets are newly persisted or exposed. Internal mutation
headers carry normalized identifiers or content hashes only.

Risk / Rollback

Risk level: Medium

Rollback notes: The previous binary is not guaranteed to support the migrated
ownership key structure. Restore the pre-deployment SQLite backup when an exact
rollback to the previous version is required. CPA panel deployments can restore
the previous panel artifact.

Verification

• Type check
• Lint
• Tests
• Build
• Manual UI check
• Docs/link check
• Not applicable, docs-only

Commands / evidence:

npm run type-check
npm run lint
npm run test                         # 133 files, 1,360 tests
npm run build                        # single-file HTML: 4,921.48 kB
npm --workspace apps/web run build:demo:bundle
npm run check:demo-isolation
npm run docs:build
npm run manager-server:test
go -C apps/manager-server test -race ./...
go -C apps/manager-server vet ./...
npm exec -- prettier --check [35 changed Web files]
git diff --check origin/main...HEAD

A real CPA instance manual smoke test was not performed.

Screenshots / Recordings

N/A — this changes mutation safety and localized error states without changing
the page layout.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated
• Demo fixtures, screenshots, and deep links reviewed
• Release notes needed
• Not needed — explanation included below

Docs decision:

No documentation update is required because this fixes existing auth-file
mutation semantics without adding configuration or a new user-facing workflow.
Demo fixtures and regression coverage are updated.

Related

N/A