USER-WP-0026-T03: access-engine application access readback client

Read FLEX-DEC-2026-019 readback answers for workloads bound in all three
records (user-engine application, protected system, key-cape client) and
show them on the account page. No row is inferred as allow; failures,
missing rows and expired allows render 'could not be checked'. Off unless
USER_ENGINE_READBACK_URL and its own token file are set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720

docs/configuration.md

@@ -83,6 +83,41 @@ contacted; the platform event never carries `client_id`. An invalid value stops
 startup — it never falls back to the legacy shape.
 
 
+## Application access readback
+
+Off unless `USER_ENGINE_READBACK_URL` is set. When it is set, these are also
+needed:
+
+- `USER_ENGINE_READBACK_URL`: base URL of access-engine's dedicated
+  `flex-auth-application-readback` pin;
+- `USER_ENGINE_READBACK_TOKEN_FILE`: the readback caller token, read on every
+  call. This is a separate file from `USER_ENGINE_FLEX_AUTH_TOKEN_FILE`. The pin
+  admits it only under the `application-readback` binding, so it can never act
+  on `/v1/check`;
+- `USER_ENGINE_READBACK_TIMEOUT`: optional, in seconds (default `3`).
+
+The account page (`/onboarding`) then lists each workload bound in all three
+records:
+
+- the user-engine application record;
+- its binding's `protected_system_id`;
+- the readback system's `client_binding`, whose issuer and client id must equal
+  our OIDC issuer and the binding's `oidc_client_id`.
+
+The rows are rendered as follows. No row is ever inferred as allow:
+
+| access-engine answer | Shown |
+| --- | --- |
+| `allow` before `expires_at` | Available |
+| `deny` | Not available |
+| `not_applicable` | Not available: not offered here |
+| failure, missing row, or `allow` past or without `expires_at` | Not available: could not be checked |
+
+Answers are read only on account-page views. They are reused per session and
+subject for at most 60 seconds, and never past the earliest allow's
+`expires_at`. Logout drops them. A failed read is not reused. Contract:
+access-engine `docs/application-access-readback.md` (FLEX-DEC-2026-019).
+
 ## Authenticator management handoff
 
 `USER_ENGINE_MFA_MANAGEMENT_URL` is optional and empty by default. When set, the