feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

core/tests/identity-database.test.ts

@@ -1,10 +1,15 @@
+import type { Pool } from "pg";
 import { describe, expect, it, vi } from "vitest";
 
 const poolConstructor = vi.hoisted(() => vi.fn());
 
 vi.mock("pg", () => ({ Pool: poolConstructor }));
 
-import { createIdentityDrizzleDatabase, IdentityDatabaseError } from "../src/identity/database.js";
+import {
+  createIdentityDrizzleDatabase,
+  createIdentityDrizzleView,
+  IdentityDatabaseError,
+} from "../src/identity/database.js";
 
 describe("Core identity Drizzle database composition", () => {
   it("does not construct a pool merely because the module is imported", () => {
@@ -141,3 +146,19 @@ describe("Core identity Drizzle database composition", () => {
     ).not.toThrow();
   });
 });
+
+describe("createIdentityDrizzleView", () => {
+  it("wraps an externally owned pool without constructing, registering an error listener on, or closing one itself", () => {
+    poolConstructor.mockClear();
+    const fakePool = { end: vi.fn(), on: vi.fn(), query: vi.fn() };
+
+    // A minimal fake pg.Pool double is sufficient — this test proves createIdentityDrizzleView
+    // never touches the pool beyond wrapping it.
+    const db = createIdentityDrizzleView(fakePool as unknown as Pool);
+
+    expect(db).toBeDefined();
+    expect(poolConstructor).not.toHaveBeenCalled();
+    expect(fakePool.on).not.toHaveBeenCalled();
+    expect(fakePool.end).not.toHaveBeenCalled();
+  });
+});