Scoped backend directory and native application support

What changed

• Separate expiring directory:read credentials are issued once, stored as hashes and revocable immediately. Bounded user, organisation, membership and role reads grant no session, mutation or management authority.
• Verified backend directory credentials use shared admission of 20 reads per second with 120 immediate burst credits per project/key. Invalid credentials keep existing request protection; no completed authorization result is cached.
• Management-only pending invitation import preserves original recipients, roles, inviters and expiry with immutable source provenance. Dry runs and repeat-safe applied results send no email; manual resend remains explicit.
• Application support requires opt-in isolated callback and fixed canonical-app authorisation. Original native actor/session proof and one-use PKCE handoff bound target sessions to 15 minutes. Applications must enforce their own current administrator/context roles.
• The MCP login prompt explicitly separates the MFA method choice from hidden code entry and permits bounded corrections to a mistaken method choice before exchanging the grant.

Release provenance