feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

core/tests/authorization-database.test.ts

@@ -1,3 +1,4 @@
+import type { Pool } from "pg";
 import { describe, expect, it, vi } from "vitest";
 
 const poolConstructor = vi.hoisted(() => vi.fn());
@@ -7,6 +8,7 @@ vi.mock("pg", () => ({ Pool: poolConstructor }));
 import {
   AuthorizationDatabaseError,
   createAuthorizationDrizzleDatabase,
+  createAuthorizationDrizzleView,
 } from "../src/authorization/database.js";
 
 describe("Core authorization Drizzle database composition", () => {
@@ -144,3 +146,19 @@ describe("Core authorization Drizzle database composition", () => {
     ).not.toThrow();
   });
 });
+
+describe("createAuthorizationDrizzleView", () => {
+  it("wraps an externally owned pool without constructing, registering an error listener on, or closing one itself", () => {
+    poolConstructor.mockClear();
+    const fakePool = { end: vi.fn(), on: vi.fn(), query: vi.fn() };
+
+    // A minimal fake pg.Pool double is sufficient — this test proves
+    // createAuthorizationDrizzleView never touches the pool beyond wrapping it.
+    const db = createAuthorizationDrizzleView(fakePool as unknown as Pool);
+
+    expect(db).toBeDefined();
+    expect(poolConstructor).not.toHaveBeenCalled();
+    expect(fakePool.on).not.toHaveBeenCalled();
+    expect(fakePool.end).not.toHaveBeenCalled();
+  });
+});