fred
e595855adc
ci/woodpecker/pr/ci Pipeline is pending
Addresses the revision-2 re-review residuals and new findings: - emailVerified joins the canonical set; defined reset rule on email change - external-principal uniqueness moved to (issuer, subject) - 'usable login method' defined for unlink refusal - shipped delete affordances (web admin, mosaic CLI) must be removed or disabled with a defined visible state; deactivation exposed instead - admin-creation switch dropped in favor of plain admin authorization - verification matrix extended: IdP removal, forward-auth non-use, first-admin SSO, wizard-recorded JIT choice, step-up positive/expiry, issuer-aliasing witness, UI/CLI delete assertions, docs observable