feat: add core authorization foundation

core/src/authorization/ports.ts

@@ -0,0 +1,28 @@
+import type { AuthorizationScope, EkklesiaUserId, PermissionId } from "@ekklesia/contracts";
+
+export interface ActiveGrantQuery {
+  readonly userId: EkklesiaUserId;
+  readonly permission: PermissionId;
+  /** Absent means an unscoped check. An unscoped grant satisfies either an unscoped or scoped
+   * check for the same permission; a scoped grant satisfies only the exact matching scope and
+   * never satisfies an unscoped check. */
+  readonly scope?: AuthorizationScope;
+  /** The instant to evaluate expiration against — injected so evaluation is deterministic and
+   * testable rather than reading the wall clock inside the lookup itself. */
+  readonly now: Date;
+}
+
+/**
+ * The only read dependency `createAuthorizationEvaluator` has for grant state. Narrow and
+ * Postgres-independent by design: a test can supply a fake implementation, and the evaluator
+ * itself never knows whether it is backed by `core/src/authorization/store.ts` or a test double.
+ */
+export interface AuthorizationGrantPort {
+  hasActiveGrant(query: ActiveGrantQuery): Promise<boolean>;
+}
+
+/** The only read dependency the evaluator has for platform-owner authority — deliberately a
+ * separate, narrower port from grants, since owner authority is not represented as a grant. */
+export interface AuthorizationPlatformOwnerPort {
+  isPlatformOwner(userId: EkklesiaUserId): Promise<boolean>;
+}