Close the account lifecycle leftovers: atomicity, bootstrap lock, redeem guard, credential delivery

Why: The login recovery contract leftovers and KTD12/KTD14 require:
concurrent same-name account creation must not overwrite the winner,
first-admin bootstrap must serialize across processes, the redeem
endpoint backoff must be shared across instances, revoked API keys
must close established SSE streams, and CLI credentials need an
env-DSN path plus a non-interactive 0600 file delivery mode.

Evidence: go test ./... green; new tests cover 16-way concurrent
create (1 win/15 conflict, winner credentials intact), 8-way
concurrent bootstrap (single admin, refuse takeover after), redeem
guard shared across two store handles on one DB, SSE stream closed
after key revocation within the recheck window, and HTTP 429 after
the failure cap (SELF worktree run; CI is the GATE, PG via test-pg).

Impact: Migration v29 (redeem_attempts); CreateAccount becomes a
single-row INSERT with unique-violation conflict; BootstrapFirstAdmin
advisory-locks (PG) / rechecks (SQLite) and commits admin+key+audit in
one transaction; SSE revalidation covers API-key streams; redeem
backoff moves to the shared DB; CLI gains AGENT_SYSTEM_DSN fallback
and --out file delivery for create/reset-password/issue-login-key/
bootstrap-admin.

Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md leftovers;
proposal r2 KTD12/KTD14/R5/R11.

cmd/agent-system/main.go

@@ -238,6 +238,28 @@ func runAPIKey(args []string) int {
 	}
 }
 
+// deliverCredential 凭据单次交付（KTD14）：--out 时写 0600 JSON 文件，stdout 只报
+// 属主/用途/文件路径不含明文；缺省沿用 stdout 一次输出。文件含 expiresAt 便于交接。
+func deliverCredential(outPath, kind, owner, plaintext string, expiresAt any) error {
+	if outPath == "" {
+		fmt.Println(plaintext)
+		return nil
+	}
+	payload := map[string]any{"kind": kind, "owner": owner, "secret": plaintext}
+	if expiresAt != nil {
+		payload["expiresAt"] = expiresAt
+	}
+	buf, err := json.MarshalIndent(payload, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(outPath, buf, 0o600); err != nil {
+		return err
+	}
+	fmt.Fprintf(os.Stderr, "凭据已写入 %s（0600，仅此一次生成；勿入库勿入日志）\n", outPath)
+	return nil
+}
+
 // runUser：create / reset-password / list / issue-login-key / revoke-login-key / bootstrap-admin。
 // 默认 create 无初始密码并签发激活 Key；--generate-password 兼容旧随机密码路径。
 func runUser(args []string) int {
@@ -260,6 +282,7 @@ func runUser(args []string) int {
 	ttlMin := fs.Int("ttl-minutes", 30, "登录 Key 有效分钟（5–120）")
 	revokeAll := fs.Bool("revoke-all-credentials", false, "签发时撤销全部长期 API Key 与会话")
 	keyID := fs.String("id", "", "revoke-login-key 凭据编号")
+	out := fs.String("out", "", "凭据交付文件（0600 JSON，代替 stdout 明文；非交互推荐）")
 	fs.Parse(args[1:])
 	switch sub {
 	case "create":
@@ -281,11 +304,16 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user create:", err)
 			return 1
 		}
-		fmt.Println(pw)
-		if *password == "" && !*generatePassword {
-			fmt.Fprintln(os.Stderr, "一次性激活 Key 仅此一次输出；兑换后设置密码。")
-		} else if *password == "" {
-			fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
+		if err := deliverCredential(*out, "login-key", *owner, pw, nil); err != nil {
+			fmt.Fprintln(os.Stderr, "user create:", err)
+			return 1
+		}
+		if *out == "" {
+			if *password == "" && !*generatePassword {
+				fmt.Fprintln(os.Stderr, "一次性激活 Key 仅此一次输出；兑换后设置密码。")
+			} else if *password == "" {
+				fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
+			}
 		}
 		return 0
 	case "reset-password":
@@ -298,8 +326,11 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user reset-password:", err)
 			return 1
 		}
-		fmt.Println(pw)
-		if *password == "" {
+		if err := deliverCredential(*out, "password", *owner, pw, nil); err != nil {
+			fmt.Fprintln(os.Stderr, "user reset-password:", err)
+			return 1
+		}
+		if *out == "" && *password == "" {
 			fmt.Fprintln(os.Stderr, "新密码仅此一次输出；该用户下次登录须修改密码（其余会话已吊销）。")
 		}
 		return 0
@@ -326,8 +357,13 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
 			return 1
 		}
-		fmt.Println(plain)
-		fmt.Fprintln(os.Stderr, "一次性登录 Key 仅此一次输出。")
+		if err := deliverCredential(*out, "login-key", *owner, plain, time.Now().Add(time.Duration(*ttlMin)*time.Minute).UTC()); err != nil {
+			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
+			return 1
+		}
+		if *out == "" {
+			fmt.Fprintln(os.Stderr, "一次性登录 Key 仅此一次输出。")
+		}
 		return 0
 	case "revoke-login-key":
 		if *keyID == "" {
@@ -350,8 +386,13 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
 			return 1
 		}
-		fmt.Println(plain)
-		fmt.Fprintln(os.Stderr, "首位管理员激活 Key 仅此一次输出。")
+		if err := deliverCredential(*out, "bootstrap-admin", *owner, plain, time.Now().Add(30*time.Minute).UTC()); err != nil {
+			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
+			return 1
+		}
+		if *out == "" {
+			fmt.Fprintln(os.Stderr, "首位管理员激活 Key 仅此一次输出。")
+		}
 		return 0
 	default:
 		fmt.Fprintln(os.Stderr, "user: 未知子命令", sub)

cmd/storage-migrate/main.go

@@ -296,6 +296,7 @@ var copyOrder = []string{
 	// U1 I3：服务实例 DB 身份（无外键；迁移须保留以免目标库丢锚）
 	"agent_system_identity",
 	"account_events",
+	"redeem_attempts",
 }
 
 const controlDDL = `