RAGE #54: mint bounded delegated Auto-Dig sessions

[lost-rob0t]

Implements #54 TDD-first after #50/#52 landed.

TDD sequence:

• tests first require trusted-caller rejection, wildcard/capability injection rejection, one-time consumption, bounded expiry, fixed StarIntel-scope -> Quasar-capability mapping, service-secret rejection, private-route-only behavior, and no registration-secret reflection;
• minimum implementation adds short-lived one-time delegated session metadata and atomic handshake consumption;
• a separate private Clack registration endpoint /internal/v1/autodig/delegated-session is now implemented and must be started explicitly with a non-empty service secret + fixed trusted service identity;
• the endpoint accepts only principal, explicit workspaces, canonical StarIntel scopes and bounded TTL; caller-supplied Quasar capabilities reject;
• no Bixby protocol or Samsung OAuth parsing is added to Quasar.

Security boundary:

• StarIntel human principal, trusted gateway/service identity, and Quasar delegated session remain separate;
• registration uses a secret header, not network location as authority;
• the service secret is never accepted in a command body, never returned, and is constant-time compared after length equality;
• wildcard workspaces reject;
• delegated WebSocket sessions remain tagged :delegated-user, preserving per-principal run isolation from RAGE #50: delegated Auto-Dig user session authority #51/RAGE #52: carry delegated principal through live WebSocket dispatch #53;
• session handshake tokens are one-time and at most 60 seconds;
• no raw StarIntel bearer token is consumed or stored by Quasar.

Remaining integration work is in the consumer/deployment boundary: wire infra #72 to this private registration endpoint, provision the service secret out-of-store, and translate the frozen Bixby routes to canonical quasar.control.v1 commands. Do not enable that consumer until this PR is exact-head green and merged.

Consumer: starintel-labs/starintel-infra#72
Refs #54.