feat: add authorization bootstrap and HTTP enforcement

Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.

vitest.migrations.integration.config.ts

@@ -7,6 +7,7 @@ export default defineConfig({
     include: [
       "core/tests/postgres-migration.integration.ts",
       "core/tests/authorization-store.integration.ts",
+      "core/tests/authorization-bootstrap.integration.ts",
       "apps/api/tests/api-http.integration.ts",
     ],
     passWithNoTests: false,