What

Brings the declarative realm manifest to feature parity with the admin surface, and fixes the export/prune bugs of the same silently-dropped-field family.

Clients — full field coverage

• AccessTokenType (the trigger bug: a manifest client with "Jwt" silently got reference tokens), applied at create and merge, exported, invalid values error contextually.
• PAR/DPoP requirement flags, all six token/session lifetimes (seconds, canonically validated), static client claims + ClientClaimsPrefix, CORS origins, ConsentType, RequireClientSecret / EnableLocalLogin / AllowRememberConsent / AllowAccessTokensViaBrowser.
• Manifest→DTO mapping deduplicated into BuildClientCreateDto / BuildClientUpdateDto; the parity drift test now compares every one of these fields between the admin path and the manifest path.

Apps — per-App settings override (ADR-0011)

• RealmManifestApp.Settings passes ApplicationSettingsDto through the canonical AppAdminService path — including the Origin subdomain that drives the global host→app routing map.
• Export emits Settings only for apps that actually have an override doc (no needless override materialization on re-apply).

Login providers — new section

• Slug-keyed upsert through the canonical handlers; Type/Flavor immutable (Manifest.ImmutableField); the seeded Internal provider is reserved (Manifest.InternalProviderReserved) and prune-protected.
• Secret: stored at create, rotated when set on an existing provider (mirrors user Password semantics), never exported.

Positions (MG-FT) — new section

• AccountName-keyed upsert: purpose, active state, terminal policy (patch semantics via the existing PositionTerminalPolicyUpdateDto), grants as user keys with desired-set reconciliation (revoking ends running shifts via the MG-FT-07 cascade).
• Feature-flag gated (Manifest.FeatureDisabled); terminal slots deliberately not modelled (device-bound credential material, like SA credentials).
• Position endpoint validators extracted onto a shared PositionOpError (exact wire bodies preserved — verified by the full 89-test position suite) so the applier reuses the endpoint rules instead of forking them.

Export/prune bug fixes

• BrowserSessions, ClientSessions, PositionSecurity realm-settings sections were missing from export (apply supported them; export→re-apply silently lost them).
• Terminal-managed clients were exported into manifests that failed the position-link invariant on re-apply — now excluded.
• Prune would have deleted terminal-managed clients (they are never in a manifest) — now protected like SA-linked clients.

Docs (docs/admin/realm-provisioning.md) and the served manifest-schema example updated.

Testing

• New RealmManifestSectionsTests (ColdStart): import/apply/export/prune per new section, incl. Internal-provider protection, host-routing assertion, grant reconciliation, and the feature gate.
• RealmManifestParityTests ClientShape extended to all new client fields; applier/export tests extended (AccessTokenType flow incl. omit-no-change and invalid-value error).
• Full Modgud.Api.Tests: 728/728, Modgud.Tests.Unit: 1542/1542.

🤖 Generated with Claude Code