feat: add workload-authenticated account-authority HTTP lookup (USER-WP-0037-T03 partial)

Exposes POST /api/v1/platform/account-authority/lookup over the existing
lookup_account_authority service method, gated by a dedicated Hub workload
bearer distinct from end-user OIDC claims and the trusted proxy secret. The
route is absent unless USER_ENGINE_HUB_AUTHORITY_TOKEN is configured.

T02 (root-grant custody/mapping) and the remainder of T03 (real workload
credential admission) depend on decisions outside this repo, per
credential-routing.md and NetKingdom's root-custody canon. Requested via
State Hub messages to net-kingdom and state-hub; workplan set to blocked.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 227621@bnt-lap001
Assistant-Session: ffcc35e9-8ffa-4881-a473-02ca94d6b366

workplans/USER-WP-0037-hub-authority-lookup.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Read-only account authority for Hub integration"
 domain: communication
 repo: user-engine
-status: active
+status: blocked
 owner: codex
 topic_slug: communication
 created: "2026-09-28"
@@ -48,7 +48,7 @@ production deployment was added. T02/T03 retain those outstanding owner gates.
 
 ```task
 id: USER-WP-0037-T02
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
 ```
@@ -58,11 +58,19 @@ platform:root to tenant:platform mapping. Do not derive a grant from JWT roles,
 a username, or Hub's configured root subject. Define retainable evidence for
 account and entitlement observations.
 
+Blocked 2026-09-28: this is a NetKingdom canon decision, not a user-engine
+implementation choice. `net-kingdom/docs/platform-root-custody.md` covers
+OpenBao/king-credential bootstrap custody but does not yet define how a
+workload-facing root-grant fact is derived, represented, or revoked for a
+consumer like the Hub. Requested via State Hub message
+`379d266b-b738-4772-82c0-318e67a50bc8` to `net-kingdom`. `AccountAuthority`
+deliberately still carries no root-grant field pending that decision.
+
 ## Authenticated workload transport and private acceptance
 
 ```task
 id: USER-WP-0037-T03
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "c5d67725-c685-50f6-9db8-28114a34014b"
 ```
@@ -72,3 +80,21 @@ workload, policy action account.authority.read, exact target binding and no
 end-user bearer forwarding. Add HTTP schema and denial/no-provisioning tests,
 then admit real caller credentials through their owner and verify withdrawal,
 outages and private Hub integration. A service method alone is not this gate.
+
+Implemented 2026-09-28: `POST /api/v1/platform/account-authority/lookup`
+(`src/user_engine/web.py`), gated by a dedicated `hub_authority_caller` /
+`hub_authority_token` pair distinct from `trusted_proxy_secret` and end-user
+OIDC claims — a bearer mismatch or unconfigured route denies/404s before any
+domain lookup runs. Wired in `runtime.py` behind
+`USER_ENGINE_HUB_AUTHORITY_TOKEN` (+ `_ISSUER`/`_SUBJECT`/`_TENANT`), unset by
+default so the route stays absent until provisioned. Schema, denial, and
+no-provisioning tests: `tests/test_web_account_authority.py` (7 tests, all
+green against `make test`, 277 tests total).
+
+Blocked 2026-09-28 on the remaining half of this gate: admitting a *real*
+Hub workload credential is a credential-routing matter
+(`.claude/rules/credential-routing.md`) — OpenBao/ops-warden issue it, this
+repo only consumes it. Requested via State Hub message
+`f3bcc516-7241-4050-ba52-5723bb174936` to `state-hub`. Withdrawal, outage,
+and private-integration verification with the real credential are still
+owed once it exists.