[access-host] - Compose one AccessHostServices graph

[JoshuaRowePhantom]

Part of #1507 and master #1505

Parent

• Direct parent: [access-host] - Track startup composition handoff and lifecycle slices #1507.
• Architecture master: [access-broker] - Unify credential-use authorization, acquisition, renewal, and presentation #1505.

Dependencies

• Depends on: [access-vscode-tunnel] - Detect and recover VS Code tunnel authentication failures #1504.
• Depends on: [access-broker-core] - Implement typed dispatch dependency cycles and shutdown #1538.
• Depends on: [access-secret-cutover] - Remove secret provider and GitHub resolver entry points #1544.
• Depends on: [access-entra] - Implement Entra credential executor and explicit renewal #1546.
• Depends on: [access-mcp-oauth-reconnect] - Reconnect MCP followers through committed cache #1550.
• Depends on: [access-authorization-ui] - Project registry snapshots into stable row view models #1551.
• Depends on: [access-dev-tunnel-cutover] - Remove parallel Dev Tunnel token providers #1560.
• Depends on: [access-api-key-cutover] - Remove API-key resolvers and OAuth source marker #1567.
• Depends on: [access-secret-dialog-cutover] - Remove modal secret dialog contracts #1568.

Summary

Create the process-lifetime owner for broker, policy, executors, coordinator, registry, rows, and administration services.

Current Limitation / Root Cause

ApplicationServices currently creates default secret services and separate MCP/Dev Tunnel objects.

Affected Files

Path	Change
Phantom.Workspaces/Services/Access/AccessHostServices.cs	Implement the bounded production change owned by this issue.
Phantom.Workspaces/Services/Access/AccessHostOptions.cs	Implement the bounded production change owned by this issue.
Phantom.Workspaces/Services/ApplicationServices.cs	Implement the bounded production change owned by this issue.
Focused test file	Add only the tests listed below.

Design / Fix

This slice implements the following exact contract:

public sealed class AccessHostServices : IAsyncDisposable
{
    public required IAccessBroker Broker { get; init; }
    public required IUserAuthorizationRegistry AuthorizationRegistry { get; init; }
    public required AuthorizationRequestRowsViewModel AuthorizationRows { get; init; }
    public static AccessHostServices Create(AccessHostOptions options);
    public ValueTask DisposeAsync();
}

Create exactly one instance of every process-wide component and validate one executor per closed request/result pair.

Use required-init properties and named object initializers. The commit must build and its focused tests must pass without relying on a second implementation slice landing in the same commit.

Security and Privacy Invariants

• Release/use authorization occurs before material access or provider interaction whenever this slice can reach either boundary.
• No token, secret value, OAuth state, verifier, authorization URL, signed URL, device code, callback, account name, unsafe identifier, or credential-bearing result enters UI-safe state, logs, notifications, entities, or persistence.
• Typed results remain caller-owned and disposable; provider/cache artifacts remain executor-owned.
• Errors are typed and sanitized; no broad catch or success-shaped fallback is introduced.

Exclusions

• No batch API, compatibility bridge, legacy-data migration, silent interactive renewal, or unrelated provider work.
• No production types beyond the bounded files/classes named here.
• No UI work unless this issue is explicitly a UI slice.

Commit Plan

Commit 1 — [access-host] - Compose one AccessHostServices graph

Production scope: Phantom.Workspaces/Services/Access/AccessHostServices.cs, Phantom.Workspaces/Services/Access/AccessHostOptions.cs, Phantom.Workspaces/Services/ApplicationServices.cs.

Tests: AccessHostServicesTests methods listed below.

Acceptance: one small coherent commit; no opportunistic adjacent migration.

Expected Tests

Test Name	Class	What It Verifies
AccessHostServices_Create_ProvidesOneBrokerRegistryAndRowsGraph	AccessHostServicesTests	Verifies the named contract and leaves adjacent slices independently testable.
AccessHostServices_Create_RegistersEachClosedExecutorExactlyOnce	AccessHostServicesTests	Verifies the named contract and leaves adjacent slices independently testable.
ApplicationServices_ContainsTypedAccessHostWithoutDefaultSecretGraph	AccessHostServicesTests	Verifies the named contract and leaves adjacent slices independently testable.