Add identity trust administration surfaces

README.md

@@ -9,13 +9,29 @@ authentication-assurance evidence, and auditable key-access trust decisions.
 It deliberately does not own login sessions, resource authorization, private
 keys, encryption, or plaintext.
 
-The headless module exposes `identity_trust.directory` and
+The backend exposes `identity_trust.directory` and
 `identity_trust.assurance`. Access or Policy must approve resource access
 first; Identity Trust then verifies the acting account, active public device
 key, current subject epoch, and assurance evidence. Encryption providers may
 consume that decision to rewrap a key, but no key material is returned by this
 module.
 
+The WebUI contributes two optional surfaces:
+
+- **Settings > Device trust** lets an account inspect active/revoked public
+  device keys, revoke a current key with its expected revision, and inspect
+  assurance level, provider, device binding, expiry, and provenance.
+- **Administration > Identity trust** lets an authorized security officer use
+  an Access-backed account selector when Access is available, inspect the same
+  bounded projections, rotate subject epochs with an upstream Access decision,
+  and review immutable key-access decisions. Explicit account references remain
+  usable when the optional Access directory is absent.
+
+Revocation and rotation are not retroactive: neither can recall plaintext,
+exports, or key material already obtained by an endpoint. Stale revisions fail
+closed and must be reloaded. The API and UI expose public JWK metadata only;
+private JWK parameters are rejected by the capability contract.
+
 Focused verification:
 
 ```bash