feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

core/tests/cli-bootstrap-platform-owner.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it, vi } from "vitest";
+
+const poolConstructor = vi.hoisted(() => vi.fn());
+
+vi.mock("pg", () => ({ Pool: poolConstructor }));
+
+describe("bootstrap-platform-owner CLI import safety", () => {
+  const originalEnv = { ...process.env };
+
+  it("does not read DATABASE_URL, connect to PostgreSQL, or run bootstrap merely by importing the module", async () => {
+    delete process.env.DATABASE_URL;
+
+    // Under Vitest, process.argv[1] is never this file's own path, so isDirectExecution() is
+    // false the same way it naturally is for apps/api/src/server.ts under its own test suite —
+    // no argv manipulation is needed to prove the guard holds.
+    await expect(import("../src/cli/bootstrap-platform-owner.js")).resolves.toBeDefined();
+
+    expect(poolConstructor).not.toHaveBeenCalled();
+
+    process.env = originalEnv;
+  });
+});