feat: implement GEWU service and local agent workflows

src/gewu/application/accounts.py

@@ -0,0 +1,52 @@
+"""Human accounts and account-owned agent credential contracts."""
+
+from dataclasses import dataclass
+from typing import Protocol
+
+from gewu.application.admin import CredentialSummary
+from gewu.application.identity import BrowserSession, Principal
+
+
+@dataclass(frozen=True)
+class AccountSummary:
+    username: str
+    principal_id: str
+    role: str
+    project_ids: list[str]
+    active: bool
+
+
+class AccountIdentity(Protocol):
+    def create_account(
+        self,
+        *,
+        username: str,
+        password: str,
+        role: str,
+        project_ids: tuple[str, ...],
+        actor: str,
+    ) -> AccountSummary: ...
+
+    def list_accounts(self, *, limit: int, offset: int) -> list[AccountSummary]: ...
+
+    def login_account(self, username: str, password: str) -> BrowserSession | None: ...
+
+    def change_account_password(
+        self, principal: Principal, current_password: str, new_password: str
+    ) -> bool: ...
+
+    def update_account(
+        self, username: str, *, role: str, project_ids: tuple[str, ...], actor: Principal
+    ) -> AccountSummary | None: ...
+
+    def disable_account(self, username: str, *, actor: Principal) -> bool: ...
+
+    def list_agent_credentials(
+        self, principal: Principal, *, limit: int, offset: int
+    ) -> list[CredentialSummary]: ...
+
+    def create_agent_credential(
+        self, principal: Principal, *, name: str, project_ids: tuple[str, ...]
+    ) -> tuple[str, str]: ...
+
+    def revoke_agent_credential(self, principal: Principal, credential_id: str) -> bool: ...