feat(identity): prepare account administration for S8

[Brad-Edwards]

Summary

Prepare policy-aware account, organization, workspace, identity, and audit administration for the coordinated S8 authority cutover. The new API adapters remain unmounted, so current production routes retain authority.

Part of #2317. All five issue acceptance criteria remain open. This PR must not finalize or close #2317. The coverage inventory maps each criterion to prepared evidence and remaining S8 work.

Changes

• Add account, organization, and workspace administration services and prepared DRF adapters with exact SQL ancestry, live policy checks, credential ceilings, and strict audit attribution.
• Extend authorization journal adapters to account and organization scopes; prepare policy-aware identity lifecycle and deployment-global audit reads.
• Reuse locked quota, egress, lifecycle, and ownership writers through policy-aware service entry points.
• Update ADR-066 and document the S8 activation boundary and unmet acceptance criteria.

Verification

• 181 focused regression tests passed for the preparation, including archive race and user-ID enumeration cases.
• An additional full-diff review covered all 32 changed files and found no new findings.
• After merging current dev, 49 targeted account/CTF integration tests, Ruff, mypy, import lint, and ADR guard passed.
• Hosted CI passed on the merged head; SonarCloud passed with zero open issues and hotspots.

Traceability

The issue has no formal Requirements UID list. Its cited PLAT-232/233/240/241 and PLAT-106/2011 clauses still require S8 live-surface reconciliation; ADR-066 and the coverage inventory identify the prepared operations and outstanding work.

[Brad-Edwards]

Delivery handoff superseded. PR #2385 prepares S8 administration but does not complete issue #2317. The previous automatic finalization pointer has been withdrawn. See the acceptance audit correction; keep #2317 open after this PR merges.

[Brad-Edwards]

gc_codex_review cycle 1 (USER-AUTHORIZED OVERRIDE past cap 3) complete for PR #2385. Posted by the MCP server to enforce the hard-cap-3 contract (issues #794, #804). Do not edit or delete — used by the next gc_codex_review invocation to count cycles.
Override reason: user said: overcap authorized

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
85.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud