Authenticate API principals and enforce scoped permissions

[fly1d]

Problem

The API currently trusts caller-supplied actor fields. A caller can impersonate an operator, agent, or reviewer, so durable audit records do not yet prove who performed an action.

Scope

• add a framework-neutral bearer authentication adapter backed by SHA-256 token fingerprints
• map authenticated subjects to explicit permissions
• require authentication and authorization for /v1 endpoints when configured
• reject write requests whose actor does not match the authenticated subject
• keep health endpoints public
• fail startup when PostgreSQL is configured without authentication
• keep an explicit unauthenticated in-memory development mode

Acceptance criteria

• missing and invalid credentials return indistinguishable 401 responses with WWW-Authenticate: Bearer
• insufficient permissions and actor mismatches return structured 403 responses
• raw bearer tokens are never stored in repository or server configuration
• unit, API security, container, and existing PostgreSQL checks pass
• security and deployment documentation identifies the static-token adapter as a bootstrap mechanism, with OIDC remaining behind the owned interface

Risk

High: authentication and authorization boundary. Requires the high-risk review path in docs/QUALITY_GATES.md.