Close pre-deploy auth gaps: deploy tokens die with repo transfers, password resets and lost admin; token revocation cascades through every descendant; agent tokens minted over REST stay within the caller's grant; TOTP failures lock out persistently; login, email removal, passkey counters, signing-key lookup and sign-out-everywhere hardened.
16 files changed+464−45
Rendering diff…