Merge branch 'main' into fix/teams-646-followups

Author: grvijayan

.changeset/delete-user-endpoint.md

@@ -0,0 +1,6 @@
+---
+"@zitadel/server": minor
+"@zitadel/api": minor
+---
+
+Add `DELETE /users/{user_id}` to delete a user from a project. Requires an OAuth2 bearer with the `user.write` scope and returns `204 No Content`.

.changeset/list-user-passkeys.md

@@ -0,0 +1,14 @@
+---
+"@zitadel/server": minor
+"@zitadel/api": minor
+---
+
+Add `GET /users/{user_id}/passkeys` to list a user's registered passkeys, 
+returning each passkey's `id`, `name`, and `created_at`. Requires an OAuth2 
+bearer with the `user.read` scope.
+
+Registered passkeys now get a name of their own instead of reusing the user's 
+display name, which was the same for every passkey a user registered (and empty 
+whenever the flow collected no identifier). A passkey takes the name the 
+registering caller supplies, and otherwise one derived from the credential 
+itself: `Security key`, `Synced passkey`, or `Device-bound passkey`.

.changeset/project-scoped-encryption-and-signing-keys.md

@@ -0,0 +1,6 @@
+---
+"@zitadel/server": minor
+"@zitadel/api": minor
+---
+
+Give every project a full key set at creation. The project key encryption key (KEK) now wraps purpose-scoped keys — token, secret and cookie encryption plus an EdDSA token signing key — and callers resolve them by purpose instead of sharing a single data-encryption key. Adds a `signing_keys` table and per-purpose "one active key per project" constraints.

.changeset/rotatable-kek.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": patch
+---
+
+Support rotatable master keys. The master key wrapping each project's key encryption key (KEK) is configured under `server.master_keys`, and wrapped keys are re-encrypted under a replacement master key on startup, with new `domain.EncryptionKey` handling for encrypt/decrypt/rotation, storage v2 crypto-key persistence for PostgreSQL and Spanner, and dedicated error definitions (`encryption_key-*`).

.changeset/rotatable-master-key.md

@@ -11,8 +11,8 @@ state of the repo.
   CLI smoke checks, npm pack dry runs, Moon release snapshots, and the
   `consumer-journey-e2e` fresh-app quality gate.
 - Local-runtime image changes should preserve the zero-config Docker smoke:
-  mounted `nextgen-data`, a generated root KEK under `keks/`, embedded Postgres,
-  and no required encryption-key configuration.
+  mounted `nextgen-data`, a generated master key under `master-keys/`, embedded
+  Postgres, and no required master-key configuration.
 - The release workflow publishes alpha npm packages and containers, then creates
   or updates a draft product GitHub Release shell. Product prose remains manual
   until maintainers publish the draft.