feat(auth): approve a FID relink from Admin > Users

[scobru]

Why

After fid 5.0 re-keyed every identity, a FID-only account (no password; the server refuses to write one) cannot be reached any more, and the owner cannot prove the account is theirs because the old key can no longer be verified. #1229 added npm run fid:relink for the operator; this makes the same fix available from the UI.

What

• The request. When the SSO gets a valid token signed with a key the instance does not know, for a username whose account already has another key and is FID-only (zen_auth_mode = 'zen'), it now records a relink request (admin.fid_relink_pub, fid_relink_requested_at) and answers 409 FID_KEY_CHANGED with relinkRequested: true and a message saying the administrator has to approve it. The first request wins (a different key gets pending until it is dismissed), so a stranger who knows the username cannot replace the owner's request. Accounts with a password never get one: they log in and link from their profile.
• Admin → Users. The row shows FID relink requested, the key, and Approve / Dismiss for the primary admin (POST /api/admin/system/users/:id/approve-fid-relink, DELETE /api/admin/system/users/:id/fid-relink, both gated on MANAGE_SYSTEM like the artist-request approval they mirror). The approve dialog tells the admin to confirm with the person that the key is the one their portal shows.
• Shared logic. modules/auth/fid-relink.ts holds relinkFid, requestRelink, approveRelink, dismissRelink; fid:relink now imports from it. Approving does exactly what the CLI does (sessions signed out, passports reset, old library records dropped).
• Docs (EN + IT) and CHANGELOG, 6.3.0. "ZEN-only" is now "FID-only" in the users list and the user modal.

Security note

A new key proves only that its holder wants the account, not that they own it. Nothing is applied until the primary admin approves, and the approval is a deliberate, confirmed step. The unauthenticated surface is the SSO route that already existed (rate limited, token signature checked); it now writes one short row per eligible account.

Test plan

• npx jest: 203 suites / 2598 tests; tsc --noEmit clean.
• New fid-relink.test.ts (request recorded not applied; first request wins and is idempotent; password / unknown / malformed never qualify; approve moves the account and clears the request; approve needs a request; dismiss leaves the account alone). New SSO integration case: a new key for a FID-only account gives FID_KEY_CHANGED, relinkRequested, no token, and exactly one UPDATE with the new key.
• Webapp: no type errors outside *.test.tsx; the 34 test-file errors in my local tsc -b are identical without this change (local install), CI builds it.
• On the real instance: sign in from the portal with the new key, then Admin → Users → Approve, then sign in again.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FeCp9YZh9dCEHXtRdpVeFe

---

Generated by Claude Code