v1.18.0

## Highlights

Engram Cloud now supports principal-based user and token management end to end.

This release replaces the old single-token cloud model with managed human users, per-user managed tokens, project grants, first-admin bootstrap, dashboard administration, and runtime managed-token authentication while preserving the legacy `ENGRAM_CLOUD_TOKEN` path during migration.

## Cloud user and token management

- Added managed principals, human users, per-user hashed tokens, and project grants backed by cloud storage.
- Enforced deny-by-default project access for managed principals on sync routes.
- Added managed-admin JSON API handlers for users, tokens, grants, enable/disable, and revoke flows.
- Added dashboard sessions for managed admins, first-admin bootstrap, and managed-user UI for tokens and grants.
- Added CLI bootstrap support for creating the first managed admin and optionally issuing the first managed token.
- Wired `engram cloud serve` so managed tokens authenticate against real runtime storage when `ENGRAM_CLOUD_TOKEN_PEPPER` is configured.

## Security and audit hardening

- Managed tokens are shown only once and stored as hashes using a dedicated token pepper.
- Disabled managed users cannot receive newly issued managed tokens.
- Revoked tokens and disabled users are rejected consistently by the runtime auth path.
- Token issuance and success audit insertion are atomic for admin API, dashboard, and bootstrap token issuance, so failed audit writes do not leave live unaudited credentials.
- Dashboard login, bootstrap, legacy recovery, deny, and admin mutation paths now record stronger audit events.

## Dashboard and operator UX

- Added managed-user dashboard pages for listing users, inspecting details, issuing tokens, granting projects, revoking tokens/grants, and enabling/disabling users.
- Disabled users no longer show an active token creation affordance.
- Disabled-user token creation attempts render a dashboard-styled `409` page instead of raw plain text.
- Docker compose examples now document `ENGRAM_CLOUD_TOKEN_PEPPER` for managed-token auth testing.

## Documentation

- Updated cloud quickstart and troubleshooting docs for managed-token bootstrap and token pepper configuration.
- Archived the OpenSpec change artifacts and promoted the cloud user token management spec.

## Validation

- Local validation before release: `go test ./...`
- Tracker PR CI: Unit Tests and E2E Tests passed.
- Local Docker QA verified authenticated mode, managed-token sync, invalid-token rejection, user/token/grant flows, revocation, disabled-user rejection, and dashboard persistence.

## Changelog

* 76cb9fea32178084bbcc54b7fbd5fa90eeb9efd1 Merge cloud user token management
* 064c20a8400e194418c4e160ea69242e471be8f5 fix(cloud): make managed token issuance audit atomic
* 4b4a85a562cf291c6dc86e5b59f39f010e12c74d fix(cloud): polish disabled token dashboard UX
* 3c6c7cea19883ad13645d9d03b0287ac10b67061 fix(cloud): reject token issuance for disabled users
* 8babe577a28e3b91b2b6223282d30a83e3ae33e3 feat(cloud): wire managed-token auth into cloud runtime
* ee2ac819c807f9cba26bd7d5d57c94fde2a65b31 feat(cloud): add CLI admin bootstrap and sync contract tests
* 7587be0e4711e20de986e494fa8a98a24e9d4cc9 feat(cloud): add managed-user dashboard UX
* 4035ab5df370d5a96767324689f973dd89ffd523 feat(cloud): audit dashboard login and legacy recovery
* 4bd03db532567a27b95f53a3c8927e5c64c26aa5 feat(cloud): add dashboard principal sessions and bootstrap
* 7172b953b7231e7371ade07d00e2a0d25ec18c19 feat(cloud): add managed admin API handlers
* 2669f3bf7b7c0d2031acb74323850bf329f13168 feat(cloud): enforce principal sync grants
* 9defadf8177eae2780aa8a73f399c00ab143354a feat(cloud): add identity storage foundation
* d4c3b386c11389997468f9af13f4e674d1412637 feat(cloud): add auth principal foundation
* a6c473dc8b577598f628122d256a1d93d6d51143 docs(cloud): plan user token management
* 18890d0d7bfa3bfa21474e5b98f2763ad3fe5b91 docs: refresh codebase setup guide
* 6fc70fb26a08d9fb9b66dac29dd3a63173136133 fix(pi): clarify native Engram provider failures
* 44faeee5731a093fa4577bd81aec0f3f7dc3e52d fix(setup): update cursor post-install test after #522 (#524)