fix: add _stored_to_legacy helper, load_auth compat, and old-format roundtrip test

docs/current_roadmap.md

@@ -102,9 +102,10 @@ auth admin are implemented. The next work is polish, not new broad surfaces.
 - Completed: server startup policy moved to `wf_server.cli`; JSON-RPC HTTP
   remains in `wf_transport_rpc_http`:
   [`server CLI and transport boundary`](superpowers/specs/2026-06-10-server-cli-transport-boundary.md).
-- Next auth work: typed/discriminated auth records, source-owned auth binders
-  (`McpAuthBinder` first), OAuth refresh-token support, and Google Drive MCP smoke
-  through `https://drivemcp.googleapis.com/mcp/v1`. Production secret manager
+- Next auth work: typed/discriminated auth records and source-owned auth binders
+  (`McpAuthBinder` first) are now completed. Remaining: OAuth refresh-token
+  support and Google Drive MCP smoke through
+  `https://drivemcp.googleapis.com/mcp/v1`. Production secret manager
   integration and encrypted-at-rest file format remain deferred.
 - Active specs:
   - [`workflow config targets and sources`](superpowers/specs/2026-06-03-workflow-config-targets-and-sources.md)

docs/superpowers/specs/2026-06-06-auth-source-secrets-boundary.md

@@ -19,7 +19,8 @@ diagnostics and source registry apply summaries. Slice 3 exposes read-only auth
 admin summaries without secret payload values. Slice 4 adds local/dev file-backed
 auth save/delete through neutral admin, JSON-RPC, and CLI. Responses still
 expose only ids, schemes, metadata, and payload keys; secret payload values
-remain write-only.
+remain write-only. Slice 5 introduces typed stored auth records and MCP auth
+binding while preserving old `scheme + payload` compatibility input.
 
 Next auth work should replace the stringly `scheme + payload` record with typed
 auth variants and source-owned auth binders. Google Drive's remote HTTP MCP