feat(channels): suggest and select active NyxID account services

[AbigailDeng]

Selecting a Skill in Channels now shows backend service recommendations, and both Bind and Edit let users choose active services available to their NyxID account even when those services were omitted at login. Remove the Manage service access button, OAuth consent instructions and channel consent-return drafts. For example, an active Firecrawl instance absent from the login token is visible, selectable and submitted by its exact UserService ID.

This console PR targets feat/2026-08-04_workflow-activity-vnext. Backend discovery is delivered separately in #3683, targeting feature/integrate. Related issue: #3678.

Behavior and contracts

• The console consumes GET /api/skills/service-recommendations?skillName=...; Skill resolution, catalog reads and inference belong to the backend. Evidence remains advisory. Selecting or clearing a Skill does not automatically select services or discard manual choices.
• The authenticated NyxID /api/v1/user-services inventory determines activity and account availability. Channel forms no longer intersect it with login allowed_service_ids or allow_all_services. Recommendations and manual selection use the same exact-instance boundary.
• Existing backend registration authorization planning, checked against feature/integrate, already verifies active UserService instances, account/organization ownership and the independent channel Agent Key scope plan. No backend change is needed for this selection rule. Organization viewer entries denied by NyxID remain unavailable; existing platform-required service rules remain in place.
• Missing, inactive or account-denied selections are removed only after a successful inventory refresh. Active saved selections outside login consent are preserved. Failed refreshes retain edits and block submission; reactivation never silently restores a previous selection.
• Exact-ID URL hints remain advisory and never auto-select an instance. Unavailable hints show an availability notice without consent instructions. Remove the unused login-grant decoder and channel redirect-draft storage.
• Save and Bind remain explicit and complete only after observing the submitted configuration. The recommendation endpoint must be deployed for suggestions to load; unavailable discovery leaves manual selection usable.

Affected paths: shared Channels inventory/recommendation adapters; shared Bind/Edit form, picker, recommendation and availability components; query keys; English/Chinese messages; focused regression tests. Updated 2026-09-28-channel-service-access.md and 2026-09-28-channel-skill-services.md document the final account-inventory semantics. The net PR diff contains only console files.

Local verification

42 tests across nine files passed. Biome passed for 17 changed frontend files. Test stability guards and whitespace checks passed.

Dependency preflight selected ten files. The unrelated workflow index.test.tsx was excluded; the nine affected Channels/API files ran explicitly. High-fan-out locales and styles were excluded from dependency discovery. Existing consent-return tests were replaced with regressions for the new selection contract; coverage includes empty login grants on both routes, exact-ID saving, Bind completion, unavailable-service cleanup, failed refreshes, reactivation and Skill suggestions outside login consent.

From repository root:

python3 /Users/abigaildeng/.codex/skills/frontend-incremental-pr/scripts/frontend_change_scope.py --repo . --base origin/feat/2026-08-04_workflow-activity-vnext
PATH="/opt/homebrew/opt/python@3.12/libexec/bin:$PATH" bash tools/ci/test_stability_guards.sh
git diff --check
git diff --cached --check

From apps/aevatar-console-web:

pnpm exec jest --listTests --runInBand --findRelatedTests \
  src/shared/api/channelServicesApi.ts \
  src/shared/api/channelSkillServicesApi.ts \
  src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelServicePicker.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelServiceAccessNotice.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelSkillServices.tsx \
  src/pages/workflow-activity-vnext/channels/queries.ts
pnpm exec jest --runInBand --runTestsByPath \
  src/shared/api/channelServicesApi.test.ts \
  src/shared/api/channelSkillServicesApi.test.ts \
  src/pages/workflow-activity-vnext/channels/ChannelServiceAccess.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelBindServiceAccess.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelSkillServices.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelEditPage.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelDefaultSkill.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelAuthorizedServices.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelsPage.test.tsx
pnpm exec biome check \
  src/locales/channelMessages.en-US.ts \
  src/locales/channelMessages.zh-CN.ts \
  src/pages/workflow-activity-vnext/channels/ChannelBindServiceAccess.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelDefaultSkill.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelEditPage.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelServiceAccess.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelServiceAccessNotice.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelServicePicker.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelSkillServices.test.tsx \
  src/pages/workflow-activity-vnext/channels/ChannelSkillServices.tsx \
  src/pages/workflow-activity-vnext/channels/connectionStyles.ts \
  src/pages/workflow-activity-vnext/channels/queries.ts \
  src/shared/api/channelServicesApi.test.ts \
  src/shared/api/channelServicesApi.ts \
  src/shared/api/channelSkillServicesApi.test.ts \
  src/shared/api/channelSkillServicesApi.ts

The actual Biome invocation used this exact list from the scope analyzer via Python subprocess. Full frontend suite, typecheck and production build are delegated to GitHub CI by personal local workflow policy. No repository-native affected typecheck is available. Live authenticated browser/save verification was not run.

Design baseline

Design baseline:
  apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
Primary design:
  aevatar-workflow-activity-vnext.excalidraw
Design SHA-256:
  30e74d7b410ae72c4c91432355436679033679c54c10b1702908435b001577de
Contract specification:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-design.md
User paths:
  apps/aevatar-console-web/docs/superpowers/specs/
  2026-08-04-workflow-activity-vnext-user-paths.md
Authentication and localization:
  Existing Aevatar login, callback, session, returnTo and Umi locale logic.
  Channel service selection follows account inventory independently of login grants.
Production data source:
  Real APIs and API-acknowledged user actions only; no mock fallback.
Baseline integrity:
  Baseline assets unchanged; compact Channels form and existing design tokens.