Redesign Account as the authoritative identity surface

[AbigailDeng]

Problem and solution

Account settings previously presented a flat subset of authentication data while the vNext shell independently rendered browser-stored identity. That could expose stale or contradictory principal state and did not distinguish session health, optional profile absence, authorization denial, or transient load failure.

This change makes GET /api/auth/me the Account authority, derives a typed identity presentation once, and passes that same principal to the shell account control. Account now shows profile, workspace context, localized absolute and relative expiry, and explicit Active / Expiring soon / Expired / Invalid states. Expired and invalid sessions receive direct sign-in recovery. Support identifiers and claims remain collapsed, individually copyable, secondary, and secret-free.

Impact paths

• Workflow Activity vNext Settings Account surface
• Workflow Activity vNext desktop and mobile shell account controls
• Shared ConsoleAuthActions optional authoritative-principal contract
• English and Simplified Chinese vNext message catalogues
• Account state classification and Settings/shared-header regression coverage

Backend contract dependency

The current GET /api/auth/me contract does not provide a typed field-visibility reason. A successful response with a missing optional value is therefore rendered as Not provided; the frontend does not infer Hidden by policy.

The account service also does not provide a typed product-capability summary. Product access remains honestly labeled Not loaded with an explanatory note, while 403 is rendered as Unauthorized and transient request failures remain Not loaded with Retry. A backend contract extension is required before policy-hidden fields or detailed capability states can be rendered authoritatively.

Local verification

• Scope analysis: python3 /Users/abigaildeng/.codex/skills/frontend-incremental-pr/scripts/frontend_change_scope.py --repo . --base origin/feat/2026-08-04_workflow-activity-vnext selected 3 Jest files and 12 static-check files.
• Related and changed tests: pnpm --dir apps/aevatar-console-web jest --selectProjects jsdom --runTestsByPath src/pages/workflow-activity-vnext/settings/accountIdentity.test.ts src/pages/workflow-activity-vnext/index.test.tsx src/shared/ui/ConsoleHeaderActions.test.tsx --runInBand passed 3 suites and 86 tests.
• Changed-file static checks: pnpm exec biome lint <12 analyzer-selected files> passed, 12 files checked with no fixes.
• Test stability: bash tools/ci/test_stability_guards.sh passed.
• Baseline integrity: python3 apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/verify-baseline.py passed; 17/17 frames, byte-identical generator output.
• Patch integrity: git diff origin/feat/2026-08-04_workflow-activity-vnext...HEAD --check passed.
• No reliable repository-native affected typecheck target is available. Full frontend suite, typecheck, and production build are delegated to GitHub CI by personal local workflow policy.

Visual verification

The local vNext Account route was opened at /scopes/scope-alpha/workflow-activity-vnext/settings?section=account. The isolated worktree correctly preserved the sanitized return URL but stopped at the existing NyxID configuration gate because NYXID_BASE_URL was not configured. No credential or authentication bypass was used. Automated integration tests cover the Account UI state families.

Design declaration

Design baseline:
  apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
Primary design:
  aevatar-workflow-activity-vnext.excalidraw
Design SHA-256:
  30e74d7b410ae72c4c91432355436679033679c54c10b1702908435b001577de
Contract specification:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-design.md
User paths:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-user-paths.md
Authentication and localization:
  Existing Aevatar login, callback, session, returnTo, and Umi locale logic;
  presentation may change, behavior may not.
Production data source:
  Real APIs and API-acknowledged user actions only; no mock fallback.
Baseline integrity:
  python3 apps/aevatar-console-web/docs/design-baselines/
  workflow-activity-vnext/verify-baseline.py

Closes #3227

Post-rebase CI follow-up verification

• Related, changed, and locale contract tests: pnpm exec jest src/pages/workflow-activity-vnext/index.test.tsx src/pages/workflow-activity-vnext/settings/accountIdentity.test.ts src/shared/ui/ConsoleHeaderActions.test.tsx src/locales/catalog.test.ts src/locales/hardcodedCopyAudit.test.ts --runInBand - passed 5 suites and 107 tests.
• Changed-file static checks: pnpm exec biome check on all 14 analyzer-selected frontend files - passed.
• Patch integrity: git diff --check - passed.
• Full frontend suite/typecheck/build: delegated to GitHub CI by the personal incremental frontend policy.