feat(auth): add provider-neutral authorization contract

[cea-block]

Summary

Adds a provider-neutral authorization contract on top of #3564. The new buzz-auth boundary turns verified identity evidence into a request for portable capabilities, validates the provider response, and returns a request-scoped capability snapshot that callers cannot construct directly.

This PR does not wire the contract into relay handlers or change runtime behavior.

This remains a draft until the Buzz-local NIP-FI lane merges and its implementation-allocation matrix is reconciled against the final public interface. It makes no discovery or conformance claim.

Security properties

• Direct requests require a current assertion whose key attestation exactly matches the authenticated Nostr actor.
• Delegated requests require verified delegation to the exact active, versioned owner binding.
• Domain, transport, principal, profile, capability, issue time, freshness, and identity bounds are preserved or revalidated before an allow becomes trusted.
• Delegated snapshots retain the exact active owner key, stable binding ID, and positive binding version used for the decision.
• Trusted snapshots contain only the exact requested capabilities and expire at the earliest provider or identity-evidence bound.
• Invitation mint and invitation claim are distinct portable capabilities.
• Denial, malformed evidence, stale policy, provider unavailability, and timeout fail closed with stable provider-neutral codes.
• Provider freshness is capped at 24 hours. Every call requires a configured timeout of at most 60 seconds; compliant providers must remain nonblocking and cancellation-safe because the timeout bounds future polling rather than preempting synchronous work.
• Debug output and errors do not expose identity, key, capability, profile, policy, time, or correlation values.
• No raw token, ingress header, vendor role/group, internal host, or deployment policy crosses this interface.

Scope

Included:

• object-safe async AuthorizationProvider interface;
• direct and delegated verified requests;
• portable capability sets and opaque policy versions;
• transport- and binding-scoped validated capability snapshots that serve as move-only finalizer evidence;
• explicit deny and unavailable outcomes;
• synthetic conformance and redaction tests.

Deferred:

• final public-contract reconciliation with the merged Buzz-local NIP-FI allocation matrix before this PR becomes ready;
• handler adoption and authorization leases;
• persistence and binding-version migration;
• invalidation, audit, and operator workflows;
• deployment-specific provider adapters;
• end-to-end NIP-FI conformance and public discovery.

Validation

• cargo test -p buzz-auth --lib: 109 passed.
• cargo clippy -p buzz-auth -p buzz-relay --all-targets -- -D warnings: passed.
• Formatting and diff checks: passed.
• The last full local just ci run completed the Rust, desktop, web, analysis, and build slices successfully; its only failure was the same unrelated Flutter test present on the exact parent: ChannelDetailPage keeps follow mode off while a tall newest message stays visible. This final contract-only delta used the focused gate above instead of repeating the full suite.
• Exact-head local review of 36b413a1cb050299962d9fa05fb2d1e6c98135a6: Claude 7/10 and GPT 9/10, both APPROVE, with no critical issues. Gemini-family coverage was explicitly waived after the installed client and documented fallback could not authenticate.
• Hosted CI on the final head: 28 passed, 4 skipped, 0 failed or pending.

Dependency and rollout

• Depends on: feat(auth): add versioned authorization context contract #3564 at 8194b888cf512090637619f0e10054d2492ac424; Buzz-local NIP-FI merge plus allocation reconciliation before ready-for-review.
• Blocks: the stable binding/persistence phase and later runtime authorization work.
• Join point: J1, after the final O1/O2 contracts and synthetic fixtures are frozen at exact reviewed SHAs.
• Activation impact: none. No handler, configuration, schema, migration, or feature default changes.
• Evidence: focused validation and exact-head local adversarial review above; hosted CI must be terminal green.
• Rollback: revert this contract-only PR. It creates no runtime state or migration to unwind.