Authenticated reserved workspace

Keys

This stays inside the protected shell, but StreamSuites still owns issuance, scope, rotation, and revocation.

Checking session...

What this milestone does not do

  • No real key creation or display.
  • No scope editor, rotation flow, or secret reveal UX yet.
  • No local key authority in this repo.