Implement keychain view reducer

AGENTS.md

@@ -108,7 +108,8 @@ Roadmap items should be actionable and checkable:
   types, untrusted discovery-backend trait, custom relay-map config, and Iroh
   local-network discovery toggle exist.
 - Canonical signed-operation envelopes exist for keychain/auth signature
-  payloads. Reducers and enforcement remain separate roadmap work.
+  payloads. The keychain reducer builds an active identity view for admin keys,
+  users, devices, nodes, agents, and endpoint bindings.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future