feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

core/src/identity/database.ts

@@ -108,3 +108,14 @@ export function createIdentityDrizzleDatabase(
     db,
   });
 }
+
+/**
+ * A typed Drizzle view over an externally owned pool — for example one shared with the
+ * authorization schema via `createValidatedPostgresPool` (`core/src/database/pool.ts`). Unlike
+ * `createIdentityDrizzleDatabase`, this function never constructs, registers an error listener
+ * on, or closes a pool itself: the caller retains that responsibility exactly once, regardless of
+ * how many typed views it creates over the same pool.
+ */
+export function createIdentityDrizzleView(pool: Pool): IdentityDrizzleDatabase {
+  return drizzle(pool, { schema: identityAdapterSchema });
+}