docs: describe approval-gated OAuth account creation

[SHAURYAKSHARMA24]

Summary

Correct capability registry and generated docs: configured OAuth may create verified new accounts through the same approval/bootstrap gate as password registration. Preserve OAuth behavior and historical identity data.

Linked issue

Related to #531.

Scope

Audit F13; baseline dev df0e82be3d7b2b7d846eefc1bcf82bde834936f2. This corrects independently verified existing behavior and advances the linked issue without adding product scope.

What changed

Correct capability registry and generated docs: configured OAuth may create verified new accounts through the same approval/bootstrap gate as password registration. Preserve OAuth behavior and historical identity data.

Acceptance criteria completed

Implementation and targeted regression coverage below. See remaining work for conditions not verified.

Testing performed

34 OAuth service tests passed, including two approval-gated account-creation cases tied to the registry statement; Ruff and regenerated registry checks passed. Real provider credentials/network not exercised.

Current head: 6854c14541c389012ae56b0327f9cc4ca8da97e9; check snapshot appears below.

Screenshots

Local screenshots and browser measurements are recorded in the remediation delivery report where applicable. Backend-only changes use contract/regression evidence.

Security and data considerations

Preserves owner scoping, source provenance, sealed graph contracts and historical data. No security gate weakened. Rollback: revert this scoped commit; see issue for migration/deployment implications.

Dependencies and blocked work

Independent dev-based PR unless explicitly stated in the issue. No unmerged changes included.

Scope changes or remaining work

Required current-head CI and maintainer review.

Please review @parthrohit22.

Contributor checklist

• Targets dev; dedicated fork branch from latest dev; issue claimed.

• Scope/evidence recorded; unrelated changes and secrets excluded.

• Targeted validation results reported accurately.

• Required current-head CI and maintainer review complete.

Current-head remediation validation

Head: 6854c14541c389012ae56b0327f9cc4ca8da97e9.

34 OAuth service tests passed, including two approval-gated account-creation cases tied to the registry statement; Ruff and regenerated registry checks passed. Real provider credentials/network not exercised.

Required current-head CI and maintainer review.

Checks at delivery: Repository Hygiene: SUCCESS; Analyze (javascript-typescript): SUCCESS; Analyze (python): SUCCESS; API Contract Drift: SUCCESS; Frontend: FAILURE; Backend: SUCCESS; Docker Build: SUCCESS; Marketing Site: SUCCESS; Prototype Browser Acceptance: SKIPPED; Vercel: FAILURE; CodeQL: SUCCESS. Required checks/reviews must pass before merge; deployment authorization was not granted.

[vercel]

@SHAURYAKSHARMA24 is attempting to deploy a commit to the parthrohit60-3117's projects Team on Vercel.

A member of the Team first needs to authorize it.

[SHAURYAKSHARMA24]

Additional validation

34 OAuth service tests passed, including two new semantic capability/approval-gate cases.
No merge or public deployment performed.