Implement scoped service identity and backend authorization #1043

Parent: #1041

Deliverable: a dedicated cell-scoped Looking Glass service identity with access limited to its supported backend operations.

Extend the fabric gateway identity and authorization path for the customer service while preserving existing operator, gateway, and node permissions. Accept project and request attribution only from an authenticated authorized service; attribution fields alone do not authorize a caller. Carry the authenticated context safely through any gateway forwarding path.

Work items:

• Implement the service identity and method authorization, including authorization for streaming RPCs and cell matching.
• Validate required project and request attribution and preserve its trust boundary through forwarding.
• Add certificate configuration and rotation support using existing identity mechanisms, with positive and negative authorization tests.

Dependencies: #1042.

Acceptance: Valid same-cell service credentials can access only the agreed service methods. Missing, invalid, expired, wrong-role, and cross-cell credentials are rejected. The service cannot call operator Query/ListNodes or node Execute/Info. Forged attribution from unauthorized callers and untrusted forwarding metadata are rejected; rotation and existing role permissions pass regression tests.