feat: self-service worker enrollment bound to a user account

Let a signed-in user turn their own machine into a worker without the
shared token. The coordinator already binds a JWT-authenticated
registration to owner_id as untrusted; this adds the missing pieces.

userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest)
with create/list/revoke and a public /worker-tokens/exchange that trades
a key for a short-lived JWT carrying the owner current role/verified.

python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token
provider exchanges the key and refreshes the JWT proactively and on 401,
so a long-running worker survives token expiry. Static bearer token path
is unchanged.

coordinator UI: an "add your machine" page that mints a key and shows a
ready-to-run command, proxying key management to the userservice; the
dashboard gains an owner-scoped "my machines" section.

docs: how to run a worker from your account, plus the untrusted/quorum/
verified trust model.

coordinator/internal/usecase/ui.go

@@ -21,6 +21,9 @@ type UIReadRepository interface {
 	ListTasksByJob(ctx context.Context, jobID uuid.UUID) ([]domain.Task, error)
 	ListTasksByJobs(ctx context.Context, jobIDs []uuid.UUID) (map[uuid.UUID][]domain.Task, error)
 	ListWorkers(ctx context.Context, limit int) ([]domain.Worker, error)
+	// ListWorkersByOwner returns the most recent workers registered by one user,
+	// for the "my machines" section of the dashboard.
+	ListWorkersByOwner(ctx context.Context, owner uuid.UUID, limit int) ([]domain.Worker, error)
 	ListArtifactsByJob(ctx context.Context, jobID uuid.UUID) ([]domain.Artifact, error)
 }
 
@@ -83,8 +86,11 @@ type WorkerCard struct {
 }
 
 type DashboardView struct {
-	Jobs          []JobCard    `json:"jobs"`
-	Workers       []WorkerCard `json:"workers"`
+	Jobs    []JobCard    `json:"jobs"`
+	Workers []WorkerCard `json:"workers"`
+	// MyWorkers is the signed-in user's own registered workers. Empty for an
+	// admin or a basic-auth operator, who instead see the whole fleet in Workers.
+	MyWorkers     []WorkerCard `json:"my_workers"`
 	ActiveJobs    int          `json:"active_jobs"`
 	FinishedJobs  int          `json:"finished_jobs"`
 	OnlineWorkers int          `json:"online_workers"`
@@ -152,15 +158,37 @@ func (d *Dashboard) Overview(ctx context.Context, limit int) (DashboardView, err
 		}
 	}
 	for _, worker := range workers {
-		out.Workers = append(out.Workers, WorkerCard{ID: worker.ID.String(), Name: worker.Name, Status: string(worker.Status), Capabilities: worker.Capabilities, LastHeartbeatAt: worker.LastHeartbeatAt})
+		out.Workers = append(out.Workers, workerCard(worker))
 		if worker.Status == domain.WorkerOnline || worker.Status == domain.WorkerBusy {
 			out.OnlineWorkers++
 		}
 	}
+	// A plain user also gets a dedicated "my machines" list scoped to their own
+	// registrations; an admin/operator sees only the fleet above.
+	if owner := uiOwnerFilter(ctx); owner != nil {
+		mine, err := d.read.ListWorkersByOwner(ctx, *owner, limit)
+		if err != nil {
+			return DashboardView{}, err
+		}
+		out.MyWorkers = make([]WorkerCard, 0, len(mine))
+		for _, worker := range mine {
+			out.MyWorkers = append(out.MyWorkers, workerCard(worker))
+		}
+	}
 	out.Session = sessionViewFrom(ctx)
 	return out, nil
 }
 
+func workerCard(w domain.Worker) WorkerCard {
+	return WorkerCard{
+		ID:              w.ID.String(),
+		Name:            w.Name,
+		Status:          string(w.Status),
+		Capabilities:    w.Capabilities,
+		LastHeartbeatAt: w.LastHeartbeatAt,
+	}
+}
+
 func (d *Dashboard) JobDetail(ctx context.Context, jobID uuid.UUID) (JobDetailView, error) {
 	job, err := d.read.GetJob(ctx, jobID)
 	if err != nil {

coordinator/internal/usecase/ui_workers_scope_test.go

@@ -0,0 +1,66 @@
+package usecase_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/emil28092005/SciMesh/coordinator/internal/domain"
+	"github.com/emil28092005/SciMesh/coordinator/internal/memstore"
+	"github.com/emil28092005/SciMesh/coordinator/internal/usecase"
+)
+
+func newDashboardWithWorkers() (*usecase.Dashboard, *memstore.WorkerRepo) {
+	jobs := memstore.NewJobRepo()
+	tasks := memstore.NewTaskRepo()
+	workers := memstore.NewWorkerRepo()
+	artifacts := memstore.NewArtifactRepo()
+	return usecase.NewDashboard(memstore.NewUIReadRepo(jobs, tasks, workers, artifacts)), workers
+}
+
+func seedWorker(t *testing.T, workers *memstore.WorkerRepo, owner *uuid.UUID, name string) {
+	t.Helper()
+	w := &domain.Worker{
+		ID:              uuid.New(),
+		Name:            name,
+		Capabilities:    []string{"similarity-search"},
+		Status:          domain.WorkerOnline,
+		OwnerID:         owner,
+		LastHeartbeatAt: time.Now().UTC(),
+	}
+	if err := workers.Insert(context.Background(), w); err != nil {
+		t.Fatalf("insert worker: %v", err)
+	}
+}
+
+func TestOverviewSplitsMyWorkers(t *testing.T) {
+	dash, workers := newDashboardWithWorkers()
+	alice, bob := uuid.New(), uuid.New()
+	seedWorker(t, workers, &alice, "alice-box")
+	seedWorker(t, workers, &bob, "bob-box")
+	seedWorker(t, workers, nil, "lab-shared") // owner-less shared-token worker
+
+	// A plain user sees the whole fleet, but MyWorkers holds only their own.
+	v, err := dash.Overview(userCtx(alice, "user"), 20)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(v.Workers) != 3 {
+		t.Errorf("fleet shows %d workers, want 3", len(v.Workers))
+	}
+	if len(v.MyWorkers) != 1 || v.MyWorkers[0].Name != "alice-box" {
+		t.Errorf("MyWorkers = %+v, want only alice-box", v.MyWorkers)
+	}
+
+	// An admin is not owner-scoped: they get the fleet and no personal list.
+	if av, _ := dash.Overview(userCtx(uuid.New(), "admin"), 20); len(av.MyWorkers) != 0 || len(av.Workers) != 3 {
+		t.Errorf("admin MyWorkers=%d Workers=%d, want 0 and 3", len(av.MyWorkers), len(av.Workers))
+	}
+
+	// A basic-auth operator (no requester) also gets no personal list.
+	if ov, _ := dash.Overview(context.Background(), 20); len(ov.MyWorkers) != 0 {
+		t.Errorf("operator MyWorkers=%d, want 0", len(ov.MyWorkers))
+	}
+}