per-user api keys, resolved at both identity doors

a user can mint a long-lived key for an app or a device instead of
carrying a 30-day session, so multiple logins on the mobile apps are
per-device revocable rather than one shared token.

identity was being decided independently in userMiddleware and
originScopeMiddleware, each verifying the token itself. teaching only
one of them a new credential format is how those two stop agreeing, so
both now call resolveAuthToken and neither knows what a bearer string
is. verified: a member's key returns the same status as their jwt on
every route tried, 403s included.

a key carries its holder's full authority — not an escalation, it
equals what the password could already do. scoping wants a scopes
column, not a change here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/chat-ui-walkthrough.md

@@ -608,4 +608,4 @@ a separate job.
   `border-box`, percentage heights resolve against the content box, so there is no overflow. I did not
   change it.
 - **Mobile edit-in-invisible-panel** (dashboards) is unrelated to this work and still open; it is
-  recorded in `nav-test-checklist.md` in the workspace root.
+  recorded under "Known and deliberately unfixed" in the workspace-root `CLAUDE.md`.