P4: OIDC Configuration UI

[GregorShear]

Extends the service account detail view (Phase 2) with trust policy management. Uses Phase 3 APIs with no backend changes.

Design doc: plans/service-accounts.md.

Scope

UX on service account detail:

• "OIDC Trust Policies" section
• "Add Trust Policy" with guided setup per provider:
  • GitHub Actions: repo name → auto-fills issuer + subject pattern
  • GitLab CI: project path → auto-fills
  • Custom: manual issuer URL + subject pattern + optional claims
• Display active policies with issuer, subject pattern, and last-used timestamp

Verification

• Create trust policy through UI → GitHub Actions workflow authenticates successfully
• Delete trust policy → subsequent workflow runs fail authentication
• Provider-specific templates pre-fill correct values