RAGE #54: trusted delegated Auto-Dig session registration

[lost-rob0t]

Tests-first owner-boundary slice for #54.

The RED contract requires a disabled-by-default trusted registration seam that can accept an already-authenticated StarIntel human principal/scopes/workspaces from an internal service adapter, register only canonical fixed Auto-Dig capabilities, and produce a short-lived WebSocket session without ever receiving a user OAuth bearer token.

Initial tests require:

• explicit internal service authentication;
• read-only scope narrowing;
• no principal/session-token reflection in the response;
• rejection of caller-supplied capability lists and wildcard workspaces;
• duplicate session-token replay rejection;
• expiry removal before WebSocket handshake.

No production registration endpoint or gateway enablement is included on this initial head. Expected state is RED.