feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

apps/api/tests/lifecycle.test.ts

@@ -176,6 +176,26 @@ describe("Ekklesia API shutdown lifecycle", () => {
     expect(poolEnd).toHaveBeenCalledTimes(1);
   });
 
+  it("constructs exactly one physical PostgreSQL pool for both the identity and authorization views, and closes only that one pool on shutdown", async () => {
+    const poolEnd = vi.fn().mockResolvedValue(undefined);
+    poolConstructor.mockImplementation(function fakePool() {
+      return { end: poolEnd, on: vi.fn() };
+    });
+    betterAuthMock.mockReturnValue({ api: { getSession: vi.fn() }, handler: vi.fn() });
+    mockSuccessfulServe();
+
+    const running = await startApi(validConfig());
+
+    // Identity (via Better Auth's Drizzle adapter) and authorization both read from the same
+    // running API, yet only one `new Pool(...)` call is ever made — proving the shared-pool
+    // composition in apps/api/src/database.ts never falls back to a second, independent pool.
+    expect(poolConstructor).toHaveBeenCalledTimes(1);
+
+    await running.shutdown();
+
+    expect(poolEnd).toHaveBeenCalledTimes(1);
+  });
+
   it("keeps shutdown idempotent for calls made after the first has already resolved", async () => {
     const poolEnd = vi.fn().mockResolvedValue(undefined);
     poolConstructor.mockImplementation(function fakePool() {
@@ -205,6 +225,7 @@ describe("Ekklesia API shutdown lifecycle", () => {
       code: "IDENTITY_CONSTRUCTION_FAILED",
     });
 
+    expect(poolConstructor).toHaveBeenCalledTimes(1);
     expect(poolEnd).toHaveBeenCalledTimes(1);
     expect(serveMock).not.toHaveBeenCalled();
   });
@@ -219,6 +240,7 @@ describe("Ekklesia API shutdown lifecycle", () => {
 
     await expect(startApi(validConfig())).rejects.toThrow();
 
+    expect(poolConstructor).toHaveBeenCalledTimes(1);
     expect(poolEnd).toHaveBeenCalledTimes(1);
   });