fix(auth): mark system tokens as non-exchangeable

[pandemicsyn]

Summary

Mark tokens created at 14 internal issuance sites so they cannot be exchanged for persistent user login credentials through native exchange:

• Personal and organization App Builder: 10 sites, tokenSource: "app-builder".
• CLI Cloud Agent session operations: 3 sites, using the existing generateCloudAgentToken helper.
• Web Security Agent analysis: 1 site, tokenSource: "security-agent".

This applies the exchange restrictions introduced by merged #5785 and #5786 without changing token lifetimes or ordinary service authentication. The PR targets main and contains only the Phase 3 changes.

Verification

No manual runtime or browser tests were performed. These are backend credential changes with no visual behavior changes; actual issuer flows and native exchange were exercised through automated integration tests instead of using live credentials or production services. Automated results are listed under Reviewer Notes.

Visual Changes

N/A

Reviewer Notes

• Review the signed markers at all 14 mint sites and the tests capturing tokens from the actual router/service paths. Signing and native exchange authentication remain real; external service boundaries are isolated.
• Tests verify the signed source, unchanged five-year lifetime and identity claims, acceptance by existing resource-token verifiers, and native exchange rejection without returned credentials or added device sessions.
• Existing unmarked tokens remain eligible under the retained legacy compatibility exception. This change neither modifies already-issued tokens nor revokes existing refresh grants.
• No global token invalidation, lifetime shortening, audience rollout, or coordinated Worker deployment. Full audience/purpose and renewal migration remains separate; source marking is transitional exchange hardening.

Automated validation after merging current main and resolving conflicts without rewriting published history:

• 372 web tests passed across ten targeted issuer/authentication/worktree suites.
• 164 shared token-verification/authentication/policy tests passed across three suites.
• pnpm --filter web lint passed.
• pnpm --filter web typecheck passed, with existing declaration-bundling external-dependency warnings.
• Changed files formatted; conflict-marker and whitespace checks passed. Resolution preserves upstream worktree behavior and the new explicit session-deletion success contract.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Phase 3 marks all 14 system-token issuance sites with tokenSource; lifetime, audience, and resource verification are unchanged, and native exchange is rejected by the existing claim-name allowlist.

Files Reviewed (8 files)

• apps/web/src/lib/security-agent/services/analysis-service.ts
• apps/web/src/lib/security-agent/services/analysis-service.token-source.test.ts
• apps/web/src/routers/app-builder-router.ts
• apps/web/src/routers/app-builder-token-source.test.ts
• apps/web/src/routers/cli-sessions-v2-router.ts
• apps/web/src/routers/cli-sessions-v2-token-source.test.ts
• apps/web/src/routers/organizations/organization-app-builder-router.ts
• apps/web/src/tests/helpers/system-token.helper.ts

---

_{Reviewed by grok-4.6 · Input: 76K · Output: 9.9K · Cached: 213.2K}

_{Review guidance: REVIEW.md from base branch main}