#164: Expose an authorization-scoped stored-evidence passive auth tracer

[justsml]

Closes #162
Closes #163
Closes #164

Scope

• Normalize bounded passive discovery evidence into deterministic auth-surface candidates, blockers, and provenance.
• Persist passive auth summaries through the canonical artifact and RAG path.
• Expose a bounded passive-auth tracer over already-stored evidence.
• Require exact target authorization and authoritative stored source/target provenance.
• Reject raw client evidence, caller-supplied labels, cross-target collection artifacts, and unsupported or oversized inputs before persistence or indexing.
• Allow curated project-scoped reference evidence while keeping collection evidence target-bound.
• Perform no network, browser, shell, or download work.

Verification

• 7 focused integration tests pass across the passive tracer, normalizer, and ArtifactService read-contract consumer.
• Typecheck passes.
• Targeted Biome and diff checks pass for the new surface.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Add a durable report fingerprint/idempotency contract so retries do not duplicate Artifact rows, blobs, or RAG chunks; land only with redaction and attribution prerequisites. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.