feat(auth): add durable audit and operator lifecycle

[cea-block]

Why

Protected authorization decisions need atomic, durable evidence, while privileged lifecycle operations need an authenticated and explicitly composed interface that remains unavailable in the stock relay.

What

• Add a typed transactional audit outbox, append-only decision queue, ordered delivery leases, bounded retry/backpressure, quarantine, dead-letter, and restore handling
• Make every production authorization evaluation pass through durable acceptance so new allows fail closed while denials remain denied and emit a bounded health signal
• Add an authenticated, capability-gated, idempotent lifecycle runtime for list, preview, revoke, and rotate with single-use authority/approval evidence and atomic invalidation
• Extend the SQLx migration chain linearly through 0050 and add non-vacuous PostgreSQL atomicity, concurrency, replay, tamper, and redaction tests
• Add a synthetic repository-native OSS reviewer playground; lifecycle routes remain unregistered by default

Risk Assessment

Medium — this changes protected authorization decision recording and adds migrations, but the operator surface requires explicit composition and is absent from the stock router. No deployment, capability grant, route activation, or external sink configuration is included.

References

• Stacked on feat(auth): install runtime status and session conformance #4790
• Local gates: focused PostgreSQL and failure-injection tests, workspace clippy, repository unit suite, formatting, migration-lineage checks, and exact production-reachability verification

Generated with Codex