test(acceptance): Cover authorization, boundary, and pagination edge cases

Close the largest coverage gap: ownership/admin authorization was
untestable end-to-end because the harness only ran under
AuthConfig::None, a fixed dev-superuser identity. Add an OAuthHarness
that self-hosts a JWKS server (an HS256 'oct' key, needing no RSA
keypair) so real AuthMode::Oauth enforcement can be driven with
distinct minted identities.

New coverage:
- Cross-user ownership is enforced with 403, and the admin escape
  hatch grants cross-user access once set_admin is called.
- Invalid bearer tokens (missing, non-bearer, expired, wrong audience,
  unknown kid) are rejected with 401.
- 404 sweep across every /api/snippets/{id}* endpoint for a
  well-formed but nonexistent route id.
- 400 for malformed route ids/hashes, distinguishing bad-request from
  not-found.
- Cross-route isolation: a hash that is a genuine version of one route
  is never readable or restorable through a different route's id, even
  though content dedup can make hashes coincide.
- PATCH with no fields, and metadata validation (overlong/illegal
  content_type, title, description) at both create and update, plus
  the exact length-boundary accept case.
- Content-addressing idempotence: empty content, cross-route content
  dedup independence, and no-op-looking updates/restores that must
  still append a ledger row.
- Pagination boundaries: empty listing, exact-limit page with no
  next_cursor (list and history), cursor replay idempotence, tampered
  cursor MAC rejection, and containment when a history cursor minted
  for one route is replayed against another route's history endpoint.
- Delivery hardening: security headers present end-to-end, and
  repeated query keys resolve deterministically.

Verified: cargo fmt --all -- --check, cargo clippy --all-features
--all-targets -- -D warnings, cargo test (95 passed), and cargo check
--features integration --test acceptance all pass. Docker is
unavailable in this sandbox, so the suite itself runs in CI.

Author: MinecraftFuns