Add account-isolated console and OAuth entry improvements

[Conner512]

Summary

• Add opt-in immutable multi-account identity, per-account Core credentials, invitation-gated registration and locally generated TOTP QR codes.
• Reuse the existing OAuth, memory, vector and worker modules with owner-bound reads and durable, idempotent provisioning. Preserve legacy identifiers and reject incompatible legacy writers after migration.
• Add a same-origin, desktop-first console with a fixed layout, three color themes, light/dark modes and Chinese/English labels. Unapproved mutations, recovery proofs, model policies and platform operations remain blocked.
• Separate console sign-in from ChatGPT OAuth login/consent. Expired or mismatched interaction links require a fresh authorization from the requesting client.
• Add an optional bounded, mutual-TLS private transport for an existing reverse proxy, with exact peer/certificate/SNI checks and a fixed loopback upstream.
• Keep Web MCP read-only, preserve handoff confirmation/receipt gates, and document migration and ingress boundaries.

Validation

• Node 24 isolated aggregate suite: 476 passed, 0 failed, 0 skipped across 11 suites.
• Locked dependency installation succeeds with lifecycle scripts disabled.
• Publication rules and Gitleaks 8.24.3 pass for the complete index and all five commits in the selected public branch lineage.
• Publication review covers implementation, generic documentation and synthetic fixtures. Runtime data, credentials, private configuration and operator evidence are excluded.

Boundaries

This is experimental and opt-in: production_ready=false. Recovery proof combinations, model spending/egress allocation, privileged console actions, mobile acceptance and real multi-account ChatGPT acceptance are not certified by these local tests. No deployment, DNS/proxy reconfiguration, real account creation or memory-data migration is triggered by merging the source changes.