feat(web): add authenticated goal creation BFF

[seonghobae]

Advances #209 with one bounded first-party authenticated Goal browser boundary. The web BFF authenticates through Identity, derives workspace authority server-side, signs the exact Planning method/path, forwards no browser credential to Planning, validates returned ownership/schema evidence, rejects duplicate/oversized collections, and exposes only browser-safe Goal evidence.

The feature history is test-first and retains the bounded media-type/duplicate-identity regressions. Protected main later advanced from the recorded branch-point f8559bf31dc098bdd58473747805a229bf860cc7 to 232a53fce43291ce19414c56e0ab5e46e653eaf7 through two commits whose resulting tree is identical to that branch point. Rather than force-rebase or transfer predecessor evidence, the branch was non-force advanced with merge commit 6dbd0ae72ffc952eca18d798d01c99c88d952275, whose parents are the prior exact feature head 82f39cff2aa5a1f105ad13588dc7f7e2920a1f04 and current protected main 232a53fce43291ce19414c56e0ab5e46e653eaf7; the feature tree remains unchanged.

Fresh exact-head CI, Security Scan, SAST Semgrep, AppGuardrail, and Commercial Readiness runs were dispatched for 6dbd0ae72ffc952eca18d798d01c99c88d952275 and are queued. No predecessor run is treated as passing evidence. The prior Security Scan failure was isolated to the central dependency-review support boundary while Scorecard/OSV/Trivy succeeded, but the new exact head must reacquire that evidence independently.

Keep Draft until the unchanged exact head has terminal required repository/security/commercial evidence, current review/thread requirements are satisfied, and live-base compatibility remains true. This slice does not add the Goals workspace UI and does not close #209.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}