FLEX-WP-0035 T01-T03: application access readback pin

Contract accepted by user-engine; FLEX-DEC-2026-019 accepted.
- serve-readback: dedicated pin, no enforcement routes, own caller binding
- CheckRequest.purpose hashed into every digest when set; /v1/check refuses it
- POST /v1/readback/application_access and GET /v1/readback/systems
- optional client_binding on protected systems; readback schemas
- schemaguard implements maxItems
- T05 added: informed-decision needs an application.access rule over
  realm-level claims (its lifecycle rules read authentication_audience)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 609675@bnt-lap001
Assistant-Session: 4987a36e-eb38-4b10-803c-15a29cd78212

cmd/flex-auth/testdata/readback/other-app/registry_snapshot.json

@@ -0,0 +1,24 @@
+{
+  "systems": [
+    {
+      "id": "other-app",
+      "name": "Other App"
+    }
+  ],
+  "subjects": [
+    {
+      "id": "other-app-profile",
+      "type": "Human",
+      "display_name": "Readback contract profile (declares caller-supplied keys)",
+      "groups": [
+        "app-users"
+      ],
+      "claims": {
+        "assurance": {
+          "level": "aal2",
+          "mfa": true
+        }
+      }
+    }
+  ]
+}