docs(access): add credential lifecycle contextual help

docs/INTERFACE_PATTERN_MIGRATION.md

@@ -52,7 +52,12 @@ through declared capabilities or metadata.
 
 - `access.workflow.grant-user-access` covers the user, group, and role path.
 - `access.reference.admin-access-fields` covers accounts, roles, API keys, and
-  reusable credentials.
+  their backing administration fields.
+- `access.workflow.manage-api-keys` owns exact help for accountable ownership,
+  bounded scopes and expiry, one-time secret custody, and immediate revocation.
+- `access.workflow.manage-service-account-credentials` owns exact help for the
+  account ceiling, activation state, credential rotation/revocation, one-time
+  secret custody, concurrency, and retirement consequences.
 - `access.reference.external-function-role-mappings` explains the
   Organizations, IDM, and Access responsibility split.
 - Files and Mail blockers link to documentation supplied by the owning module.

docs/SERVICE_ACCOUNTS.md

@@ -39,3 +39,14 @@ deactivates the principal and revokes all active credentials.
 Credential list responses never contain a secret. Create and rotate responses
 contain it once. Audit records include identifiers, prefixes, scopes, and the
 new service-account revision, but never the secret or its hash.
+
+## Contextual help
+
+F1 on the service-account page, its editors, scope controls, one-time secret,
+rotation and revocation actions, activation state, or retirement confirmation
+resolves to the Access-owned `access.workflow.manage-service-account-credentials`
+topic. The German reference content distinguishes reversible deactivation from
+retirement, explains immediate client impact, and states that secrets cannot be
+recovered. Tenant API-key controls resolve separately to
+`access.workflow.manage-api-keys`, because their effective authorization also
+depends on the accountable human owner's current permissions.