Add device-code enrollment and multi-token bearer auth

[andrew-jon-p7a]

Summary

Replaces the "create a member, copy the token, paste it into your VM config" onboarding flow with a gh-auth-style device-code handshake (RFC 8628). The bearer plaintext now travels directly from the broker to the operator's CLI on its next poll — never through copy-paste, terminal scrollback, or chat threads.

• ac7 connect on the device prints a short user code + verification URL; the director (signed in via TOTP) approves in the browser; the CLI's next poll resolves with the bearer and writes it to ~/.config/ac7/auth.json (mode 0o600).
• Multi-token per member. New tokens SQLite table replaces single-token-per-member. Each device gets its own labeled row; rotating no longer kicks every peer offline.
• RFC 8628-shaped wire. Pending/error states return 400 + {error: <code>} (authorization_pending / slow_down / expired_token / access_denied); success returns 200 with the bearer.
• Backward compatible. --token flag and AC7_TOKEN env var still work — CLI's makeClient() resolves in order: flag → env → saved entry. Existing CI scripts keep running.
• Wizard unchanged. First admin's bootstrap token still mints directly (no director exists yet to approve).

What's in here

Server

• apps/server/src/tokens.ts — TokenStore (SQLite tokens table, KEK-aware, debounced last_used_at updates).
• apps/server/src/enrollments.ts — EnrollmentStore (SQLite pending_enrollments, KEK-wraps issued plaintext at rest, RFC 8628 outcomes).
• apps/server/src/app.ts — five new routes (/enroll, /enroll/poll, /enroll/pending, /enroll/approve, /enroll/reject) + two token-mgmt routes (GET/DELETE /members/:name/tokens(/:id)). Per-IP rate limit (10/hr) on /enroll.
• apps/server/src/auth.ts — bearer resolver now reads from TokenStore; binds tokenId to the request context.
• apps/server/src/run.ts — boot-time idempotent migration of ac7.json tokenHash → tokens table.

SDK — types, schemas, paths, client methods for the eight new endpoints.

CLI — new ac7 connect command with box-banner UI, RFC 8628 poll backoff, SIGINT-safe cancellation. New auth-config.ts helper for ~/.config/ac7/auth.json (XDG / macOS / Windows aware).

Web — new /enroll SPA route (handles its own anonymous → login bounce), MemberTokenList under member admin, PendingEnrollments panel auto-refreshing under MembersPanel.

Docs — README onboarding now points at ac7 connect; new docs/enrollment.mdx covers the flow, RFC 8628 alignment, security posture, multi-token semantics, and the legacy ac7 rotate break-glass.

Security posture

• Device code (32 bytes, ~256 bits) is a shared secret in transit; broker stores only its sha256 hash.
• User code (8 chars Crockford base32, no I/L/O/U) is shown to humans; bounded by /enroll rate limit + 5-min single-use TTL.
• Issued bearer plaintext is KEK-wrapped (AES-256-GCM, same KEK that wraps TOTP/VAPID) between approval and the device's next poll.
• Single-use semantics: a successful poll deletes the row in the same transaction. Replays return expired_token.
• Director-side gating: members.manage required to approve/reject. The operator running ac7 connect cannot approve themselves.
• Source IP / UA captured at mint time, displayed to the director — never enforced.

Test plan

• Server suite: 352 passing (38 new across tokens.test.ts, enrollments.test.ts, enroll-endpoints.test.ts)
• CLI suite: 117 passing (3 new connect.test.ts covering happy path, access_denied, expired_token)
• Web-shell suite: 161 passing (no regressions)
• Core suite: 87 passing
• pnpm run lint: 0 errors, 0 warnings
• All five touched packages typecheck and build cleanly
• Manual smoke: spin up ac7 serve, run ac7 connect on a second machine, approve via web UI, verify token works for ac7 claude-code
• Manual smoke: rotate-token revokes every peer token; member delete revokes all tokens
• Manual smoke: enrollment expires cleanly after 5 min if not approved
• Manual smoke: deep link ?code=… is cleared from history bar after read

Decisions worth flagging in review

• Naming: new command is ac7 connect, not ac7 enroll — the latter already exists for TOTP enrollment for web UI sign-in. The two are semantically different (machine onboarding vs human web-login enrollment); keeping them distinct avoids overloading.
• ac7 rotate semantics changed. Previously: single-token replacement. Now: revokes every active token for the member and mints one fresh — the break-glass posture for "I think a token leaked." Adding a new device should use ac7 connect, which adds a peer token without touching the others.
• ac7.json tokenHash is no longer load-bearing after first boot. SQLite is the resolver's source of truth; the JSON hash is preserved for human-readability and hand-edit support but the resolver doesn't read it after migration.
• Audit log: structured logger.info() calls on every state mutation (enrollment minted/approved/rejected, token revoked/rotated, etc). A dedicated audit_log SQL table is a future enhancement; the structured log is sufficient for v1.

🤖 Generated with Claude Code