fix: enforce target policies for search-mode invocations

[joshrotenberg]

Closes #271.

Search-mode proxy/call_tool previously dispatched straight to the raw backend proxy, dropping caller extensions and skipping authorization and argument transforms. It now rewrites the original request before the ordinary invocation stack: the public target receives the same bearer/JWT policy, filters, aliases, validation, cache, overrides, and injection as a direct call. Request identity, cancellation context, progress, continuation, and task fields remain intact; recursive and management targets are rejected. Raw admin-tool registration refuses the wrapper rather than providing a bypass.

Composite calls now require the caller's permission for both the composite and each public target. Targets use the same policy stack before caches and backend dispatch; permitted members may still run when another is denied, and the aggregate reports an error. Nested composites remain unsupported. README, API docs, and architecture instructions document these rules.

Validation: all six AGENTS.md checks passed (strict fmt/Clippy/rustdoc, 323 unit tests, 140 integration tests including real Redis, and 24 doctests). Configured HTTP/session regressions cover signed JWT roles, scoped bearer tokens, denied targets receiving zero backend calls, warm-cache denial, custom separators, alias/argument parity on cache misses and hits, and size limits. Context tests cover continuation/cancellation preservation and invalid/recursive targets. The no-default all-target build and discovery-only HTTP regression also pass. JWT tests use a documented public test-only RSA fixture; the new dev dependency was already present in the lockfile through tower-mcp.

Manual review of the pushed diff at f3bc0b77c93ab208776a8b682d734cce025a6a9e completed with no remaining findings. Git dependency pins are unchanged. Releases remain held.