Connections: the platform owns OAuth sign-ins, the flow, and the audit page

[czpython]

An extension's OAuth surface is a declaration and a loop:

class NightWatch(Extension):
    name = "night_watch"
    acme = Acme.with_scopes("profile.read", "posts.write")

for connection in NightWatch.acme.list_for_account(account_id):
    token = await connection.mint_access_token()

The grant model, its migration, the rotation verbs with their transaction
topology, and the hand-rolled connect/callback routes all leave the author
surface.

Connections are platform rows

A connection is one signed-in provider account — a mailbox, a handle, a
workspace. oauth_connections holds one row per sign-in, N per provider,
owned by the druks account that completed the consent: the encrypted
refresh token, the granted scopes, the consent time. The engine rotates the
refresh token on mint — fresh read under the refresh lock, rotated token
committed on its own session before the cache fills — once, as private
methods on the row, instead of copied into every consumer.

McpOauthGrant is gone. MCP registers a fresh dynamic client on every
connect, so each connection keeps its own client: that half becomes
McpClientRegistration, pointing at the server row, with the RFC 8707
resource read live from the server's url. MCP keeps its
one-per-(server, account) policy over the shared table. The migration moves
the rows and re-encrypts each secret under its new table.column AAD.

Declarations feed the consent

Scopes belong to the consumer. Acme.with_scopes(...) on the Extension
class declares the app's use of a service; the consent asks for the union
of every installed declaration, derived by walking the loaded extension
classes — no registry to drift. The handle reads the connections that grant
it: list_for_account(account_id), get(connection_id).

The platform runs the flow

GET /api/oauth/{name}/connect begins consent with the scope union and
stores a new connection for the session account;
?connection=<id> reconsents an existing one — widened scopes replace its
tokens and the stale cached access token is evicted. One global
GET /api/oauth/callback serves every service: connect state is keyed by
the state value alone and the provider rides the stash.
DELETE /api/oauth/connections/{id} revokes one connection. Consent and
revocation are session-identity actions, never an agent PAT's. Replacing a
service's client credentials deletes its connections — a new client can
never refresh the old client's tokens.

The surfaces

Settings grows a Connections page — everything the signed-in user has
authenticated to, across services, revoked per connection. The service
detail card lists that service's sign-ins beside the pasted client
credentials, with reconnect offered when an installed extension declares a
scope a connection lacks. App UIs own the connect button and the domain
rendering of their sign-ins.

Notes

• Redis token-cache and refresh-lock keys change shape (keyed by connection
  id). Deploys are stop-then-start, so the cost is one cache miss per
  connection after the deploy; stale locks expire by TTL.
• MCP keeps its own callback path: every dynamically-registered client has
  it pinned as a redirect_uri.
• The migration's data move is exercised only by the schema chain in CI,
  not by a seeded-data test — seeding the pre-split schema mid-chain needs
  a harness the one-time move does not justify. Flagging rather than
  hiding it.