[P1][CONN-02] Identity/auth lifecycle and account isolation

Programme: #1
Epic: #18

## Objective
Broker connector identity/authentication so multiple accounts can coexist without leaking data, credentials or write authority across them.

## Scope
- OAuth/OIDC/device-code and provider-specific auth adapters where required.
- Account identity records and explicit account selector in every read/write context.
- Token refresh/rotation/revocation through the vault; never place raw secrets in model context.
- Audience/downstream restrictions for delegated credentials.
- Re-auth/expiry UX and capability suspension when auth becomes invalid.
- Per-account cache/index/source scope and connection health.
- Logout/account removal with credential purge and derivative-data policy hooks.

## Security rules
- No token passthrough between unrelated providers/audiences.
- Connector identity and user-visible account identity must agree before consequential writes.
- Same provider with multiple accounts must remain logically and cryptographically separate where possible.

## Acceptance criteria
- [ ] Two accounts on the same connector never reuse private cache data or write authority.
- [ ] Expired/revoked tokens stop new operations and surface actionable re-auth state.
- [ ] Raw credentials remain absent from prompts, traces and general worker environments.
- [ ] Write previews show the exact provider/account identity.
- [ ] Account removal revokes credentials and follows configured local-data deletion/retention rules.
- [ ] Cross-account confusion/adversarial fixtures fail closed.

## Dependencies
- CONN-01
- SEC-03

**First phase:** P1
**Maturity target:** P4
**Owner:** connectors-domains

## Task issues
- [ ] #381 `CONN-02.T01` — Model accounts and connection ownership
- [ ] #382 `CONN-02.T02` — Implement supported authentication flows
- [ ] #383 `CONN-02.T03` — Broker credential storage and use
- [ ] #384 `CONN-02.T04` — Implement refresh concurrency and revocation
- [ ] #385 `CONN-02.T05` — Enforce account-scoped caches and indices
- [ ] #386 `CONN-02.T06` — Implement logout, connection removal and reauthentication
- [ ] #387 `CONN-02.T07` — Run multi-account auth conformance

Start by reading the dependency issues CONN-01 and SEC-03, then review task issues #381–#387 to understand the intended implementation boundaries. Use the acceptance criteria as the completion checklist, including account isolation, credential handling, re-authentication, write identity previews, removal policy, and fail-closed adversarial fixtures.

Written by the indexing model from the issue text.