authenticated principal + encrypted delegated-credential capture

[swelborn]

capture the principal - (iss,sub) - and the token when we have an incoming request

the “Real” solution to this would be tokens with offline access. However we cannot currently do this with our idp

---

This is part 18 of 23 in a stack made with GitButler:

•  23  use historical=True as a fallback if job not found #52
•  22  test coverage for credential boundary #51
•  21  remove "force" option for cache shutdown #50
•  20  client/service/workflow changes for IRI token delegation changes #49
•  19  add cache table to track caches #48
•  18  authenticated principal + encrypted delegated-credential capture #47 👈
•  17  OIDC transfer ownership and delegated user credentials #46
•  16  WIP for shared cache shutdown #45
•  15  add jobspec override #44
•  14  add mostly claude-gen usage example package #43
•  13  ability to share a cache amongst different transfers #42
•  12  add precommit hook for checking openapi client drift #40
•  11  pin python version to 3.14 #41
•  10  build frontend image in CI #39
•  9  add frontend #38
•  8  add frontend client (autogenerated) #37
•  7  lazily construct settings #36
•  6  add autogenerated client #35
•  5  add alembic #34
•  4  add ability to get logs from v2 api services thru iri #29
•  3  functional core tests for transfer and producer #30
•  2  api with durable execution and saga #28
•  1  deps for v2 #27