Task: Scaffold story: Implement the credentials journeys in ores.web

Land the story that owns the Credentials journey group: the story page, the prototype tasks, the sprint row and the programme's order table. The design record is the group's three journey documents, and this task does not touch them.

• The story exists in Sprint 26, and the sprint's * Stories table links it.
• The programme story's order table names this story against the Credentials group, in place of "not yet scaffolded".
• Each of the three Credentials journeys has a prototype task under the story.
• The story states the prototype-first order and the decision that the journey documents stay with the extraction pass.
• compass lint passes and the pages publish.

1. Scaffold the story with compass add story.
2. Write the goal, the acceptance, the plan, the decisions, the out-of-scope list and the documents.
3. Scaffold the four tasks with compass add task, so each one is wired into the story's * Tasks table.
4. Wire the story into the sprint's * Stories table, and into the programme's order table.
5. Raise the scaffold PR. The three prototype tasks stay BACKLOG until the PR merges.

• The group is the fourth of eight in Implement the user journeys in ores.web, after Setup, Entry and Profile. The programme writes one story per group, so this story is the group's story and carries the build after the prototypes.
• The three journey documents were written in sprint 25 and carry #+updated: 2026-09-23. The extraction pass has not reached ores.iam yet, so the documents are stale against the tree in at least one place: the Protect my account document says the change-password handler ignores current_password, and account_operations_service::change_password verifies it on this tree. The prototypes check every claim they render, and the story records what they find.
• The tree at the branch point already carries the journey runtime from the Setup group (projects/ores.web/packages/web/src/journeys/runtime.ts), so a prototype rides the real rail rather than a port of the sprint 25 throwaway.
• The prototype method follows Prototype ORE Studio bootstrap in ores.web: one branch per journey, several variants on one route, and a verdict on the task.

Done 2026-09-30. PR #2431.

The Credentials group has a story, three prototype tasks, a row in sprint 26 and a row in the programme's order table:

The programme's order table also gained the Entry row, which named no story although Implement the entry journeys in ores.web already existed.

Two facts were checked while scaffolding, and both are recorded on the story:

• The three journey documents are stale. They carry #+updated: 2026-09-23, and the extraction pass has not reached ores.iam. The Protect my account document says the change-password handler ignores current_password; account_operations_service::change_password verifies it on this tree.
• The browser has no path to any credentials data. The BFF serves the caller's own session and the password change, and nothing else. The credentials routes that do exist — /api/v1/iam/sessions, /sessions/active, /login_info, /accounts, /accounts/lock, /accounts/unlock and /accounts/reset-password — are ores.http's, which the browser never reaches. Two journey documents claimed a working /api/v1/sessions/active read for the browser, and named the wrong surface.

Verification: compass lint passes on the scaffold PR (filetags and generator markers valid; the durable-document link advisory is unchanged at 180 links across 89 files). The story was read back from the sprint's * Stories table, and its four tasks were wired into its * Tasks table by compass add task.