feat: add canonical identity administration

docs/IDENTITY_MODEL.md

@@ -75,6 +75,17 @@ Rollout plan:
 The close-out condition is that Access works with canonical Identity installed
 and still works without it through the projection fallback.
 
-The current lifecycle service is intentionally not an administration API.
-Identity administration screens and endpoint permissions remain tracked
-separately; IDM continues to own external import/reconciliation decisions.
+## Administration surface
+
+Identity now exposes a system-scoped administration API and an embedded
+administration workspace. Administrators can create, inspect, update,
+deactivate, and reactivate identities, then add or remove opaque platform
+account references and promote one link as primary. The first account link is
+made primary automatically. A primary link cannot be removed while another
+link remains; the replacement must be promoted first.
+
+The current tenant is retained as the actor context, but it does not make the
+canonical identity record tenant-owned. Every mutation is therefore written as
+a system-scoped audit event. Identity does not inspect account credentials or
+authorization state and does not treat deactivation as account suspension.
+IDM continues to own external import and reconciliation decisions.