feat: Implement console session management with tenant and profile handling

- Add ConsoleSessionStore for managing console session state including tenants, profile, and token information.
- Create OperatorContextService to manage operator context for orchestrator actions.
- Implement OperatorMetadataInterceptor to enrich HTTP requests with operator context metadata.
- Develop ConsoleProfileComponent to display user profile and session details, including tenant information and access tokens.
- Add corresponding HTML and SCSS for ConsoleProfileComponent to enhance UI presentation.
- Write unit tests for ConsoleProfileComponent to ensure correct rendering and functionality.

docs/ARCHITECTURE_CLI.md

@@ -103,6 +103,18 @@ src/
 * `whoami` — short auth display.
 * `version` — CLI + protocol versions; release channel.
 
+### 2.9 Aggregation-only guard helpers
+
+* `sources ingest --dry-run --source <id> --input <path|uri> [--tenant ... --format table|json --output file]`
+
+  * Normalises documents (handles gzip/base64), posts them to the backend `aoc/ingest/dry-run` route, and exits non-zero when guard violations are detected.
+  * Defaults to table output with ANSI colour; `--json`/`--output` produce deterministic JSON for CI pipelines.
+
+* `aoc verify [--since <ISO8601|duration>] [--limit <count>] [--sources list] [--codes list] [--format table|json] [--export file] [--tenant id] [--no-color]`
+
+  * Replays guard checks against stored raw documents. Maps backend `ERR_AOC_00x` codes onto deterministic exit codes so CI can block regressions.
+  * Supports pagination hints (`--limit`, `--since`), tenant scoping via `--tenant` or `STELLA_TENANT`, and JSON exports for evidence lockers.
+
 ---
 
 ## 3) AuthN: Authority + DPoP
@@ -154,6 +166,10 @@ CLI rejects verbs if required scopes are missing.
 | 6    | Rate limited / quota exceeded               |
 | 7    | Backend unavailable (retryable)             |
 | 9    | Invalid arguments                           |
+| 11–17 | Aggregation-only guard violation (`ERR_AOC_00x`) |
+| 18   | Verification truncated (increase `--limit`) |
+| 70   | Transport/authentication failure            |
+| 71   | CLI usage error (missing tenant, invalid cursor) |
 
 ---