feat(auth): add connection access foundations (stages 01–06)

[alimek]

Summary

Add server foundations for per-device project/provider/model access. This consolidates accepted stages01–06 from PRs#16–#30 into one change against feature/connection-resource-access; the source tree and29 existing commits are unchanged.

connection authority + resource grant
  → current project/thread admission
  → filtered reads, streams and mutation receipts
  → restricted extra-tool denial and safe provider catalog
  → device-bound files, uploads and asset delivery

Legacy unrestricted connections retain existing behavior. Resource-restricted connections deny extra T3 Git/PR/MCP/automation tools in simple v1. Restricted grant issuance remains CLOSED until execution admission, durable run authority, client controls and final integration are complete.

Refs#1,#2,#3,#4,#5,#6,#7. Supersedes individual stack PRs#16–#29; their reviews and validation remain in the closed PR records.

Evidence

• Before: real SQL/Deferred controls reproduced retained hidden-file reads, image dimensions after an owner cut and GitHub HTTP effects after an authority cut.
  After: the accepted fixes deny those effects; coordinator reran55/55 affected asset tests at b66e06efeb8caaf9c0137ed31940bd06e0121f18.
• All six stages passed separate Standards/Spec source reviews, focused behavior tests, touched-file lint/format and relevant named package typechecks. Final reviews had zero remaining findings.
• Consolidation verifies all15 exact accepted heads/ancestry, unchanged final tree, remote refs, clean accepted worktree and diff checks. No code rewritten or branches deleted.
• Full fork CI remains queued; no full-CI or integrated web/desktop/mobile validation claim. Previously reproduced inherited mode-only diff/raw cascade assertions remain documented in the original reviews.

Merge Danger

Door: two-way

PR consolidation changes metadata only. This code includes auth/resource-grant and pending-upload persistence migrations; no live database is touched here. Merge into the feature branch does not activate restricted access.

Blast Radius: server

Execution admission07, durable authority08, shared client state11, web12, mobile13 and activation/integrated verification14 remain. Stage07 is paused with its separate uncommitted changes preserved.

Model: gpt-6.1-sol. Harness: Codex.