identuum-ui v0.9.13

The static console export for identuum-idp-oss v0.9.13: your connected
apps in Account settings, administrator reset links, a sign-in policy per
organization, a console that works on a phone, and plain words where the
server refuses.

• See and remove the apps that use your account. Account settings has
  a new "Applications" tab, also in the member menu. It lists each app you
  allowed, what it can see in plain words (for example "your email
  address" or "stay signed in") and the day you allowed it. "Remove
  access" asks first: the app will have to ask you again, and it may keep
  working for a short time, which the page states from the server's own
  setting. The Overview has an "Applications" card with the count and a
  "Review" link. A server without this feature says "Not available on
  this server." After a removal, the line "Access removed for ."
  stays on the page and keyboard focus moves to it.

• The user page says when a new password is due. When an
  administrator set a person's password and the person has not yet
  changed it, the user page shows "Must choose a new password at next
  sign-in."

• Reset links say why they cannot be made. When a reset link is
  refused, the user page now says why in plain words: the person has not
  activated the account, signs in only with a provider, belongs to an
  organization that allows only provider sign-in, or the server cannot
  make reset links yet. A "Done" button closes the link, and it is not
  shown again. The button follows the server's own setting on every
  edition.

• An expired password is named at sign-in. When a password set by an
  administrator has expired, the sign-in page says so and tells the person
  to ask for a new reset link, instead of "Invalid credentials".

• A taken domain is named. When a new organization cannot be created
  because its domain may already be in use, the Domain field says so,
  instead of "The backend returned an error".

• A taken name or email address is named too. When a new
  organization's name, domain or administrator email address is already
  in use, the server now says which, and that field shows it.

• The audit filter lists what the server records. The event types in
  the audit log filter now come from the server, on every edition, in
  groups with plain-word names. When the server cannot send the list, the
  filter says so and the other filters still work.

• A reset link that could not sign you out elsewhere. When the new
  password was set but your other sign-ins could not be ended, the page
  says the password was changed and asks you to have your administrator
  end the other sessions. It does not offer to try again.

• The console works on a phone. On screens narrower than 768 px the
  menu at the left is hidden, so pages no longer scroll sideways. A
  "Menu" button at the top opens the same menu, with Sign out, from the
  left. Tap a link, tap outside the menu, press Escape or press "Close
  menu" to close it. With a keyboard, focus stays in the open menu and
  goes back to "Menu" when it closes. A long email address at the top is
  cut short; the account menu shows all of it. On wider screens nothing
  changes.

• Choose how members sign in. In Settings, the "Sign-in providers" card
  has a "Change" button next to the sign-in policy. Choose "Password only",
  "Password or a sign-in provider" or "Sign-in provider only". "Sign-in
  provider only" stays off until the organization has an active provider.
  A move to or from it asks first and says who it affects: going to it,
  members who only have a password cannot sign in; going to "Password
  only", members who only sign in with a provider cannot sign in; going to
  both, passwords work again. A site administrator sees the policy and is
  told that only the organization's own administrator can change it.

• Removing the last provider is explained. When members can only sign in
  with a provider, the card says why its only provider cannot be removed,
  before you press "Remove…".

• Two people editing one application. When someone else saved the
  application after you opened it, your save is refused and nothing is
  lost: a banner offers "Load the latest version" or "Save my version
  anyway". Your typed values stay in the form.

• Plain words when a provider sign-in is refused: when the invitation is
  not accepted yet, when an administrator has not approved the account yet,
  when the provider did not share the email address, when the sign-in did
  not work or took too long, when the account may not sign in this way, or
  when the provider or sign-in cannot be reached. A sign-in address with a
  made-up reason shows no message, instead of an empty box or an error page.

• Administrators can verify their own email address from Account
  settings, Profile, like members on their Overview. The site administrator
  sees the status only.

• Smaller fixes: "Not verified yet" is not repeated when the server cannot
  send email, and the line is read out by screen readers; a click outside
  the remove dialog no longer lets focus escape it; "Passkeys" marks
  Security in the member menu; a provider error that starts with a name,
  such as "Google", keeps its capital letter; a server that does not offer
  sign-in providers is not reported as "Provider removed"; "User not found"
  is shown for both spellings of the server's answer; the account menu
  reads the email address outside the menu items; the phone menu keeps
  focus in place when the screen gets wider.

Verification machinery (repository-visible, not in the export)

• e2e-full exercises authenticator setup (initiate and complete), the
  caller's own consents (list and remove; the app's refresh token is then
  refused) and the administrator's reset link with its public validate and
  redeem pair. The role matrix grows 315 -> 332 committed cells; the
  closure set 55 -> 57.
• The role matrix's denominators follow the identuum-idp-oss golden to
  166/109/36 (total/role/class endpoints) for GET
  /api/v1/audit/event-types; no cells are added until a spec exercises it.