Remove synthetic preview account switching and recover logout links

[dinpd]

Closes #360.

Summary

• Hide the production account header only in the synthetic workflow preview, removing fake signed-in/logout/sign-in/account-switching UI.
• Explain that no real account is signed in locally and that real editing requires appropriate live-console membership.
• Recover old localhost logout links with a fixed same-origin, non-cacheable redirect to the read-only agent page; do not clear cookies or touch production authentication.
• Keep unbacked settings and recurring-console pages within the inspector preview, with clear notice that real console pages require the live console.
• Document the distinction between synthetic viewer access and real console roles.

Acceptance And Security

• 341 console tests pass, including authorization, tenant isolation, redaction and CSP checks.
• Workflow inspector browser acceptance passes in Chrome on desktop 1440x1050 and mobile 390x844. Verified hidden preview account controls, clear account-session disclosure, safe logout recovery with no cookie clearing or writes, retained inspection/workspace switching, disabled trial/save controls, and normal owner/viewer account headers outside preview mode. Reviewed desktop/mobile screenshots.
• Final extended acceptance passes for fixed redirects from logout, workspace-settings and recurring-console pages, including actual mobile settings-link navigation; no inspection writes.
• Console Wrangler dry run passes; production dependency audit reports zero vulnerabilities; git diff --check passes.
• Manual complete-diff review: no production runtime, UI, role, authentication or CSP changes; no dependencies, credentials or live workspace data changed. Redirect target is fixed, local, and does not forward supplied return URLs or account data. CSS is appended only to the same-origin fixture stylesheet and does not weaken CSP.
• No human acceptance needed for these programmatically proven criteria. No real login/logout or permission changes performed.

Release Impact

No release: confined to the test-only synthetic preview, regression coverage and documentation. Production behavior and v0.48.0-rc.1 remain unchanged.

Local Recovery

The owned preview server on port 8794 is restarted with this fix. Existing logout tabs can be refreshed to recover to the preview; the live console remains the destination for actual editing and trials.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T16:59:13.313417Z	52c68aa	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.