fix(auth): preserve legacy CLI tokens during workflow issuance

[pandemicsyn]

Workflow startup needlessly initialized an account’s previously null API-token pepper in #6059

Keep the account’s existing pepper, including explicit null, and issue scoped workflow tokens using the already-supported nullable contract. Reload stale null snapshots from the primary database without writing to the account. Audience restrictions, one-hour workflow TTLs, runtime authorization, and revocation checks remain enforced.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The null-pepper preservation fix is internally consistent: workflow tokens now carry an explicit null pepper that matches the account's persisted null across every verifier, and genuine pepper rotation still revokes prior credentials. No bugs, security regressions, or memory concerns found in the changed lines.

Files Reviewed (11 files)

• apps/web/src/lib/auth/cloud-agent-workflow-compat.test.ts
• apps/web/src/lib/auth/cloud-agent-workflow-user.test.ts
• apps/web/src/lib/auth/cloud-agent-workflow-user.ts
• apps/web/src/lib/auth/resource-delegation.servicecontrol.test.ts
• apps/web/src/lib/auto-fix/triggers/prepare-fix-payload.test.ts
• apps/web/src/lib/auto-triage/triggers/prepare-triage-payload.test.ts
• apps/web/src/lib/security-agent/services/analysis-service.resource-tokens.test.ts
• apps/web/src/lib/security-agent/services/analysis-service.token-source.test.ts
• apps/web/src/lib/tokens.ts
• docs/token-issuance-policy.md
• packages/worker-utils/src/runtime-authorization.test.ts

Verification Notes

• prepareCloudAgentWorkflowUser now reloads null-pepper snapshots from the primary (db, not readDb) without writing, so a pepper assigned after the snapshot is still observed and no credentials are revoked.
• generateCloudAgentWorkflowToken / generateWorkflowGatewayToken relax only the explicit null case; undefined and '' still throw, and runtime admission still rejects an absent pepper claim.
• Downstream verifiers (verifyKiloBearerAgainstCurrentPepper, createRuntimeAuthorization/requireBindings, web resolveUserFromAuth) all compare a present null claim against the persisted null, so issued workflow tokens authenticate.
• Rotation to a non-null pepper changes digest(null) from 'null', revoking created and renewed runtime authorizations as the new tests assert.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}