feat(api): agent identity on v2 meta, scoped CLI pairing keys, and v2 workspace rename (#9904)

* feat(api): agent identity on v2 meta, scoped CLI pairing keys, and v2 workspace rename

- GET /api/v2/meta adds keyId, userId, workspaceId and links {openapi, docs, mcp};
  existing fields unchanged. The API catalog shares the same link source.
- CLI pairing login accepts --read-only and --expires-in <days>. The request rides
  the approval URL, is shown on the approval card, is recorded with the approval
  and applied at mint; the unauthenticated poll cannot set either. The poll echoes
  access and expiresAt, and the CLI refuses to store a key that does not match
  what was asked (an older server mints full access). The signed-out login bounce
  now keeps scope, workspace, access and expiry instead of dropping them.
  sim whoami shows the key's expiry and bound workspace.
- POST /api/v2/credentials/connections returns draftId. Opening a connection link
  that is unknown, expired or another account's now explains to sign in as the
  creating account, without saying which case applied.
- PATCH /api/v2/workspaces/{workspaceId} renames a workspace or changes its logo
  through the existing workspaces.identity.update operation, widened to personal
  API keys and OAuth tokens (api:write); Admin still required, workspace keys
  still denied. Workspace update operations move into the operations registry.
- Regenerated OpenAPI, MCP catalog, CLI client and CLI docs.

* fix(cli-auth): pass route context in the new approve and poll tests

* test(mcp): expect the identity fields getMeta now returns

* fix(workspaces): count members before the rename so a failed count never hides a committed update

* improvement(cli-auth): reuse the api-key access schema and tidy handoff validation

* fix(api): publish the workspace PATCH body rules and check CLI-minted keys exactly

- PATCH /v2/workspaces/{id}: the body schema publishes minProperties 1, and
  logoUrl is a pattern (root-relative path or https URL, protocol-relative
  refused) instead of an unpublished refine.
- sim login refuses a minted key whose access or expiry differs from the
  request in either direction, with the expiry checked against the requested
  days within a clock tolerance.
- sim workspaces update --logo-url documents that clearing the logo goes
  through the API or MCP.

Author: waleedlatif1

apps/docs/content/docs/cli/commands.mdx

@@ -79,9 +79,10 @@ sim login [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
-| `--method <method>` | No | Credential to obtain: oauth requires OAuth support; api-key creates a permanent key through pairing (auto-selects when omitted). Accepted values: `oauth`, `api-key`. |
+| `--method <method>` | No | Credential to obtain: oauth requires OAuth support; api-key creates an API key through pairing (auto-selects when omitted). Accepted values: `oauth`, `api-key`. |
 | `--no-browser` | No | Print the approval URL without opening it (either login method). |
 | `--read-only` | No | Ask only for permission to read, never to change anything. |
+| `--expires-in <days>` | No | API-key login only: days until the key expires (1-365); omit for a key that never expires. |
 | `--callback-port <port>` | No | Pin the local port the browser returns to. |
 | `-y, --yes` | No | Overwrite an existing API-key profile without prompting. |
 

apps/docs/content/docs/cli/reference.mdx

@@ -47,9 +47,10 @@ sim login [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
-| `--method <method>` | No | Credential to obtain: oauth requires OAuth support; api-key creates a permanent key through pairing (auto-selects when omitted). Accepted values: `oauth`, `api-key`. |
+| `--method <method>` | No | Credential to obtain: oauth requires OAuth support; api-key creates an API key through pairing (auto-selects when omitted). Accepted values: `oauth`, `api-key`. |
 | `--no-browser` | No | Print the approval URL without opening it (either login method). |
 | `--read-only` | No | Ask only for permission to read, never to change anything. |
+| `--expires-in <days>` | No | API-key login only: days until the key expires (1-365); omit for a key that never expires. |
 | `--callback-port <port>` | No | Pin the local port the browser returns to. |
 | `-y, --yes` | No | Overwrite an existing API-key profile without prompting. |
 
@@ -9239,6 +9240,27 @@ sim workspaces unlink [options]
 
 API request and response schemas: [unlinkWorkspaceFork](/api-reference/workspace-sync/unlinkWorkspaceFork).
 
+### sim workspaces update
+
+Update workspace (OAuth login or personal API key required)
+
+```bash
+sim workspaces update [options]
+```
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | No | New workspace display name. |
+| `--logo-url <value>` | No | New workspace logo: a root-relative path (starting with /) or an https:// URL. To remove the logo, send logoUrl: null through the API or MCP (--logo-url null sends the word, not JSON null). |
+
+</CommandTable>
+
+API request and response schemas: [updateWorkspace](/api-reference/workspaces/updateWorkspace).
+
 ### sim workspaces sync-exclusions
 
 Update workspace fork exclusions (OAuth login or personal API key required)

apps/docs/content/docs/cli/workspaces.mdx

@@ -41,6 +41,27 @@ sim workspaces get
 
 API request and response schemas: [getWorkspace](/api-reference/workspaces/getWorkspace).
 
+### Update workspace
+
+OAuth login or personal API key required.
+
+```bash
+sim workspaces update [options]
+```
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `--name <value>` | No | New workspace display name. |
+| `--logo-url <value>` | No | New workspace logo: a root-relative path (starting with /) or an https:// URL. To remove the logo, send logoUrl: null through the API or MCP (--logo-url null sends the word, not JSON null). |
+
+</CommandTable>
+
+API request and response schemas: [updateWorkspace](/api-reference/workspaces/updateWorkspace).
+
 ### List workspace members
 
 ```bash