mini-console: design + Slice 0 runnable skeleton

[wolpert]

What this is

Graduates mini-console from roadmap placeholder to a runnable, admin-only skeleton, plus the design docs that scope the whole effort. ./gradlew build is green family-wide.

Design docs (docs/design/)

• mini-console.md — full design: the two faces (operator console + end-to-end exercise harness), five new HTTP client libs + reuse of the existing mini-kms client, the security model ("no new authority"; the one new downstream-token concentration), and a slice-by-slice roadmap.
• mini-console-slice0.md — the Slice 0 implementation plan (source-cited).
• DIRECTION.md — records mini-kms's client as the deliberate socket-era exception: relocating it into libs/mini-kms-client was designed and independently reviewed (mechanically clean) but declined — cosmetic parity for real churn in three shipping services.

Slice 0 (services/mini-console/)

• Loopback HTTP server (virtual-thread-per-request).
• Paste-the-console-token login minting a mini-token SessionService session under a distinct mini-console-session cookie (never the shared SSO cookie).
• An honest Dashboard: n/a — client not wired yet (Slice N) for each service; calls nothing downstream and fabricates no health data.
• Reuses the family http/ router kit + JsonStore + AdminAuthenticator + Cookies verbatim.
• No-oracle login (wrong vs missing token indistinguishable), double-submit CSRF on both POSTs, loopback bind, no secrets in logs, session store written 0600.

The trip-wire fires by design

Deletes MiniConsole.IMPLEMENTED (referenced only by the guard test) and MiniConsoleTest, replacing them with real ConsoleServer/ConsoleConfig tests — the module can no longer claim "placeholder."

Honest seams / deliberately NOT here

• libs/mini-client-common is deferred to Slice 1, so its API is driven by its first real consumer (the directory client) rather than landing as an unconsumed abstraction.
• /api JSON surface + OpenAPI/SwaggerUI are Slice 8.
• The console adds no new authority — Slice 0 holds only its own bootstrap console token (env/file, never argv, never logged).

Verification

• ./gradlew build — BUILD SUCCESSFUL, family-wide; 14 console tests pass, no pre-existing regressions.
• ./gradlew :services:mini-console:installDist produces bin/mini-console.
• Smoke: /health public; / → 302 → /login unauthenticated; CSRF+token login → 302 → /; authenticated Dashboard renders console-admin + "client not wired yet"; token absent from logs; console-sessions.json written 0600.

🤖 Generated with Claude Code