fix: enforce installed HTTP auth profiles

Install the REST auth profile registry once at composition and make it the
single transport authority for V3. Contract composition now rejects an
unregistered authProfileId, so the executor never resolves a profile at
runtime.

The credential collaborator contributes proof headers only: Fetch credentials
come from the resolved profile, transport-owned and forbidden headers are
rejected, headers outside the profile's allowed set are rejected, and a missing
required header fails closed as AUTH_INTEGRATION_FAILURE with zero fetch calls.
The final invariant re-proves credentials mode and the exact header sets.

Demo mode satisfies the strict bearer profile with a fixed non-secret marker
instead of weakening REFERENCE_EXTERNAL_BEARER. Credential owners now receive
the operation lifetime through AuthOperationContext.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/auth/external-session-adapter.ts

@@ -1,24 +1,26 @@
 import type {
   AuthSessionPort,
+  CredentialOperationContext,
   CredentialPatch,
   CredentialRequestBinding,
   SessionState,
 } from "../../application/ports/auth-session-port.ts";
+import { CREDENTIAL_HEADER_NAMES } from "../../contracts/rest-profiles.ts";
 
 export type ExternalSessionOwner = Readonly<{
   readState(): SessionState;
   subscribe(listener: () => void): () => void;
   beginSignIn(returnTo?: string): Promise<void>;
   signOut(): Promise<void>;
-  attachCredential(binding: CredentialRequestBinding): Promise<CredentialPatch>;
+  attachCredential(
+    binding: CredentialRequestBinding,
+    context?: CredentialOperationContext,
+  ): Promise<CredentialPatch>;
   recoverSession(): Promise<"restored" | "no-session">;
   notifyUnauthenticated(): void;
 }>;
 
-const ALLOWED_CREDENTIAL_HEADERS = new Set([
-  "authorization",
-  "x-csrf-token",
-]);
+const ALLOWED_CREDENTIAL_HEADERS = new Set<string>(CREDENTIAL_HEADER_NAMES);
 const MAX_HEADER_VALUE_BYTES = 8_192;
 
 export function validateCredentialPatch(value: unknown): CredentialPatch {
@@ -54,8 +56,10 @@ export function createExternalAuthSessionAdapter(
     subscribe: (listener) => owner.subscribe(listener),
     beginSignIn: (returnTo) => owner.beginSignIn(returnTo),
     signOut: () => owner.signOut(),
-    async credentialPatch(binding) {
-      return validateCredentialPatch(await owner.attachCredential(binding));
+    async credentialPatch(binding, context) {
+      return validateCredentialPatch(
+        await owner.attachCredential(binding, context),
+      );
     },
     async recover() {
       const result = await owner.recoverSession();
@@ -85,9 +89,23 @@ export function createAnonymousSessionAdapter(): AuthSessionPort {
 export type DemoSessionAdapter = AuthSessionPort &
   Readonly<{ setState(next: SessionState): void }>;
 
+/**
+ * §7.7. `AUTH_MODE=demo` still runs against the strict
+ * `REFERENCE_EXTERNAL_BEARER` profile, so the demo owner must supply a real
+ * proof header. This marker is a fixed, non-secret placeholder: it exists so
+ * the demo path satisfies the bearer contract instead of weakening it.
+ */
+export const DEMO_AUTHORIZATION_MARKER = "Bearer demo-session-not-a-secret";
+
+const DEMO_PATCH = Object.freeze({
+  headers: Object.freeze({ authorization: DEMO_AUTHORIZATION_MARKER }),
+});
+
 export function createDemoSessionAdapter(
   initialState: SessionState = "unauthenticated",
+  demoPatch: CredentialPatch = DEMO_PATCH,
 ): DemoSessionAdapter {
+  const patch = validateCredentialPatch(demoPatch);
   let state = initialState;
   const listeners = new Set<() => void>();
   const setState = (next: SessionState) => {
@@ -106,7 +124,7 @@ export function createDemoSessionAdapter(
     async signOut() {
       setState("unauthenticated");
     },
-    credentialPatch: async () => EMPTY_PATCH,
+    credentialPatch: async () => patch,
     async recover() {
       if (state === "recovery-pending") {
         setState("authenticated");