feat: add server store role overrides

docs/current_roadmap.md

@@ -252,6 +252,13 @@ implementation state.
     `server.store` as the fallback for every missing role. First implementation
     should stay filesystem-only; secret managers, SQL, and object stores are
     later backend implementations.
+    First role-specific store slice complete: neutral config now accepts optional
+    `server.stores.workflow`, `server.stores.auth`,
+    `server.stores.source_registry`, and `server.stores.catalog_cache`
+    filesystem overrides. Missing roles still fall back to `server.store`.
+    MCP compatibility still uses one `FileStore` class for auth and catalog
+    snapshots internally; the separate catalog root is carried for the future
+    store split.
   - Completed: `wf run watch` starts run progress UX with polling over existing
     `inspect_run` and optional bounded `read_run_trace`. SSE/WebSocket/MCP
     progress remains deferred until polling UX proves insufficient.

docs/superpowers/specs/2026-06-03-workflow-config-targets-and-sources.md

@@ -252,6 +252,9 @@ optional role-specific overrides without breaking existing files:
 }
 ```
 
+Implementation status: first filesystem-only slice implemented. Role overrides
+are optional and fall back to `server.store`.
+
 Resolution rule:
 
 ```text

docs/wf_cli.md

@@ -55,9 +55,10 @@ The old `store_root` field maps to
 
 `server.store` is currently the default root for all file-backed server state:
 workflow artifacts/deployments/runs, source registry entries, catalog cache, and
-local/dev auth records. Future configs may add role-specific store overrides
-such as `server.stores.auth` or `server.stores.source_registry`; missing roles
-should continue to fall back to `server.store`.
+local/dev auth records. Role-specific store overrides are now supported via
+`server.stores.*` (e.g. `server.stores.workflow`, `server.stores.auth`,
+`server.stores.source_registry`, `server.stores.catalog_cache`); missing roles
+continue to fall back to `server.store`.
 
 Start a JSON-RPC server backed by MCP broker config and MCP-capable sources: