Accountable kit

Same OpenID Connect login, plus a revoke webhook, holdings API, and fake 5-year invoice retention.

Declared retention

Email and display name on invoices for 5 years (bookkeeping). Not a login after revoke.