feat: add auth admin mutations

src/wf_api/admin.py

@@ -4,6 +4,8 @@ from collections.abc import Mapping, Sequence
 from dataclasses import asdict, is_dataclass
 from typing import Any, Protocol
 
+from wf_api.auth import AuthRecord
+
 
 class WorkflowAdminConnectionProvider(Protocol):
     """Provides read-only connection inventory for admin frontends."""
@@ -20,12 +22,16 @@ class WorkflowAdminEventProvider(Protocol):
 
 
 class WorkflowAdminAuthProvider(Protocol):
-    """Provides read-only auth inventory without secret payload values."""
+    """Provides auth inventory and local/dev auth mutation."""
 
     def list_auth_records(self) -> Sequence[Mapping[str, Any] | object]: ...
 
     def inspect_auth_record(self, auth_ref: str) -> Mapping[str, Any] | object: ...
 
+    def save_auth_record(self, record: AuthRecord) -> Mapping[str, Any] | object: ...
+
+    def delete_auth_record(self, auth_ref: str) -> Mapping[str, Any] | object: ...
+
 
 class WorkflowAdminApi:
     """Protocol-neutral read-only broker/server admin operations.
@@ -79,6 +85,29 @@ class WorkflowAdminApi:
             raise RuntimeError("auth admin is not available for this target")
         return _payload(self.auth.inspect_auth_record(auth_ref))
 
+    async def save_auth_record(
+        self,
+        *,
+        auth_ref: str,
+        scheme: str,
+        payload: Mapping[str, object],
+        metadata: Mapping[str, object] | None = None,
+    ) -> dict[str, Any]:
+        if self.auth is None:
+            raise RuntimeError("auth admin is not available for this target")
+        record = AuthRecord(
+            id=auth_ref,
+            scheme=scheme,
+            payload=dict(payload),
+            metadata=dict(metadata or {}),
+        )
+        return _payload(self.auth.save_auth_record(record))
+
+    async def delete_auth_record(self, auth_ref: str) -> dict[str, Any]:
+        if self.auth is None:
+            raise RuntimeError("auth admin is not available for this target")
+        return _payload(self.auth.delete_auth_record(auth_ref))
+
 
 def _payload(value: Mapping[str, Any] | object) -> dict[str, Any]:
     """Normalize provider objects without depending on MCP event/config types."""

src/wf_api/surface.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from typing import Any, Protocol
 
 from wf_artifacts import ArtifactKind
@@ -229,6 +229,17 @@ class WorkflowAdminSurface(Protocol):
 
     async def inspect_auth_record(self, auth_ref: str) -> dict[str, Any]: ...
 
+    async def save_auth_record(
+        self,
+        *,
+        auth_ref: str,
+        scheme: str,
+        payload: Mapping[str, object],
+        metadata: Mapping[str, object] | None = None,
+    ) -> dict[str, Any]: ...
+
+    async def delete_auth_record(self, auth_ref: str) -> dict[str, Any]: ...
+
 
 class WorkflowSourceRegistrySurface(Protocol):
     """Desired source registry methods exposed by platform frontends."""