feat: add auth admin mutations

docs/current_roadmap.md

@@ -238,8 +238,12 @@ implementation state.
     available through MCP-backed server admin, JSON-RPC, and CLI. Summaries show
     ids, schemes, metadata, and payload keys only; secret payload values remain
     hidden.
-    Not done: auth is still compatibility-grade. There is no auth mutation UI/CLI,
-    OAuth flow, production secret manager, provider-specific display model, or
+    Fourth implementation slice complete: local/dev auth records can be saved and
+    deleted through neutral admin, JSON-RPC, and `wf admin auth`. This is still not
+    a production secret manager or OAuth flow; payload values are accepted only as
+    write inputs and never returned.
+    Not done: auth is still compatibility-grade. There is no OAuth flow,
+    production secret manager, provider-specific display model, or
     full removal of the legacy MCP auth record shape yet.
   - Completed: `wf run watch` starts run progress UX with polling over existing
     `inspect_run` and optional bounded `read_run_trace`. SSE/WebSocket/MCP

docs/superpowers/specs/2026-06-06-auth-source-secrets-boundary.md

@@ -16,8 +16,11 @@ the architecture.
 Slice 1 implements the neutral auth record/store protocol and MCP compatibility
 bridge. Slice 2 surfaces missing explicit auth refs through live source
 diagnostics and source registry apply summaries. Slice 3 exposes read-only auth
-admin summaries without secret payload values. Auth mutation surfaces and
-provider-specific auth unions are future slices.
+admin summaries without secret payload values. Slice 4 adds local/dev file-backed
+auth save/delete through neutral admin, JSON-RPC, and CLI. Responses still
+expose only ids, schemes, metadata, and payload keys; secret payload values
+remain write-only. OAuth, production secret managers, and provider-specific auth
+variants remain future work.
 
 This is not a complete auth product yet. The implemented runtime path only wires
 existing MCP-compatible auth records into source calls, diagnostics, and

docs/wf_cli.md

@@ -286,6 +286,21 @@ generate prose.
 
 ## Common Diagnostics
 
+### Local/dev auth records
+
+Auth payload values are write-only. `list`, `inspect`, `save`, and `delete`
+responses show ids, schemes, metadata, and payload keys only.
+
+```powershell
+wf admin auth save drive.work --scheme bearer --payload-file drive-auth.json
+wf admin auth list
+wf admin auth inspect drive.work
+wf admin auth delete drive.work --confirm
+```
+
+Use source `auth_ref` values to point sources at these records. Do not commit
+payload files containing real secrets.
+
 ### `source_missing`
 
 A required logical source is not available or not bound.