USER-WP-0026-T03: access-engine application access readback client

Read FLEX-DEC-2026-019 readback answers for workloads bound in all three
records (user-engine application, protected system, key-cape client) and
show them on the account page. No row is inferred as allow; failures,
missing rows and expired allows render 'could not be checked'. Off unless
USER_ENGINE_READBACK_URL and its own token file are set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720

layer.yaml

@@ -64,6 +64,14 @@ non_tooling_clients:
     write: false
     note: Engine API. The shape §5 prescribes for a PEP-shaped consumer.
 
+  - id: access-engine-application-readback
+    target: access-engine
+    layer: engine
+    module: src/user_engine/adapters/application_access.py
+    operation: "HTTP GET /v1/readback/systems and POST /v1/readback/application_access"
+    write: false
+    note: "Engine API, dedicated readback pin (FLEX-DEC-2026-019). Display only; readback decisions authorize nothing and no row is inferred as allow."
+
   - id: oidc-claim-input
     target: key-cape
     layer: tooling-as-claim-input