Changelog

Club OWNER-only scope grants

Replaced the P0 “unsupported for every issuer” decision for club.compliance.read_files, club.safety.read_sensitive, club.coaches.read, club.coaches.write, and club.federations.read with an exact-current-club OWNER-only grant rule.
Kept permission wildcard and role evidence separate: ADMIN, custom wildcard holders and owners of other clubs cannot grant these scopes.
Applied one server-owned grant ceiling to the scope catalog, credential creation and scope update. Existing keys retain explicit scopes only; strict reduction remains available and rotation does not expand them.

Published signed-only authentication; removed obsolete Bearer and runtime mock-demo guidance.
Frozen the current inventory at 96 explicit controller operations: public GET /health plus 95 signed /v1 operations on 85 path templates.
Added equal-route bilingual OpenAPI, source-ledger drift checks, missing-translation and missing-spec failures, and bilingual docs build gates.
Documented workspace Redis limits, fail-closed idempotency, five signing webhook events, canonical reconciliation and current provisioning/worker limitations.

Added explicit PARTNER_ROLE=api|worker startup with backward-compatible api default and fail-fast unknown roles.
Moved webhook queue consumption and recovery out of every Academy mode into the health-only worker; retained the shared producer in Partner API and Academy.
Added independent API/worker Kubernetes Deployments from the same bundle. Only the API has a Service/public route.
Added isolated Postgres/Redis runtime checks for role routes, queue registry identity, consumer ownership and shutdown.