fix(erasure): an erased subject cannot write where SQL cannot see it

[42-v]

Follow-up to #82, which closed PUT /user/profile by making auth.users refuse the write itself. The other subject-writing routes cannot be closed that way, and the reason is the point:

identity.profiles is keyed by an unlinkable pseudonym — no user_id, no foreign key. That is exactly what makes it pseudonymous, and also what makes the database blind to the connection. Blobs are the same shape, and the MFA setup routes never load the user row at all.

So PUT /user/identity recreated a name, date of birth, billing address and VAT id on a subject the erasure had scrubbed, and nothing in the request path knew: the handler does not resolve the user, and Auth deliberately never reads the database.

What this does

RequireLiveAccount is a lookup, applied to the five routes that persist subject-owned data and to nothing else:

Route	Guard
PUT /user/identity	authedLive
POST /user/blobs	authedLive
PUT /user/blobs/named/{name}	authedLive
POST /auth/2fa/totp/setup	confirmedLive
POST /auth/2fa/backup-codes	confirmedLive

Read routes keep the stateless fast path that self-contained tokens exist to provide. PUT /user/profile stays out of it deliberately — a second guard there would cost a round trip while hiding where the real invariant lives. It fails closed: a lookup error is a 401, because a database that cannot answer is not permission to write personal data back onto a possibly-erased subject.

Three existing gates had to learn the new wrapper names

Each was worth the edit rather than a nuisance, and the repo had already anticipated it — the OWASP A01 gate keeps a guardComposes map precisely so a new guard's name cannot be trusted on its own:

• OWASP A01 (authGuards + guardComposes) — verifies the closure really composes authMw
• NIST IA-11 — verifies the confirmation guard
• DPoP route wiring (dpopWrapperIdents + routeBuilderClosures) — verifies both route and closure body

Two register rationales cited server.go by line and this change moved both; they now point at the statements they always meant (:546→:559, :847→:861).

Mutation-verified: swapping authedLive back to authed on one route fails the new gate by name. It reads comment-free source, because the liveness meta-gate is right that a construct appearing only in a comment would otherwise satisfy the assertion.

Verified: go build ./..., go vet ./..., go test -race on middleware/server/handler, tests/spec and tests/compliance both green, golangci-lint run ./... 0 issues on a cleaned cache, misspell clean.

fix(erasure): an erased subject cannot write where SQL cannot see it