feat(auth): enforce fail-closed protected authorization

[cea-block]

Why

Build on #4772 by ensuring protected operations consume a single validated authorization context and fail closed when identity evidence, provider provenance, or revocation state is missing, stale, or ambiguous.

What

• Add typed authorization evidence, provider provenance, binding, reason, lease, and finalization contracts
• Enforce deny-protected defaults and route coverage across relay, database, media, git, audio, and workflow paths
• Add durable revocation and invalidation, authority epochs, client-status projections, and provider-neutral runtime conformance coverage
• Add SQLx migrations 0030 through 0045 in one unique linear sequence

Risk Assessment

High — this changes core authorization and protected data paths across several server components and includes database migrations. The PR is draft-only and does not deploy or activate the feature.

References

• Depends on feat(db): add durable identity binding lifecycle #4772
• This draft temporarily targets the frozen O3 review base so the diff contains O4 only; it will be mechanically restacked and retargeted after feat(db): add durable identity binding lifecycle #4772 lands
• Focused authorization fixture validation: CARGO_BUILD_JOBS=2 RUST_TEST_THREADS=2 cargo test -p buzz-auth --lib --locked -j 2 finalization::tests
• Rust formatting checks: cargo fmt --all -- --check; cargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all -- --check
• Historical failed head: 872e1b5 (https://github.com/block/buzz/actions/runs/30943592479)
• Exact reviewed head: 54d2c31

Generated with Codex