Commit history for src/server/api
- MCP review fixes: account scope on usage API, MCP-only audience for pre-existing OAuth grants, unregistered identity survives delegation, token-derived lease holders, metering off the request path, and a fail-closed test hook.db0bf11⌁taigrr committed
- MCP: registered agent identities with agent-bound tokens, mcp-audience tokens with an explicit git/REST opt-in, per-account tool-call metering, and a loopback-only eviction hook for tests.004a5d0⌁taigrr committed
- Merge roadmap/mergefixb1edaa2⌁taigrr committed
- Merge roadmap/editorf5c6bf8⌁taigrr committed
- Merge roadmap/runnerd0ce09d⌁taigrr committed
- Harden git, LFS, CI, Pages, auth and pull requests against the security review findings, and add a token API for the gfd CLI.4e8720e⌁taigrr committed
