docs: record core authorization architecture

Adds ADR 0013 documenting the durable Phase 4C decisions (permission
registry, evaluator baselines, grant/scope semantics, platform-owner
bootstrap, shared database pool, Origin enforcement, and what remains
deferred), cross-links it from the authorization/README docs, and
refreshes the pnpm doctor no-DATABASE_URL example output in README.md
and repository-workflow.md to include the authorization migration.

docs/development/authorization.md

@@ -3,8 +3,10 @@
 Phase 4C establishes Core's authorization foundation and, in a second slice, wires it into
 `apps/api` over HTTP. This page covers both: the schema/evaluator/store/registry Core owns, the
 platform-owner bootstrap operation, and the enforcement/endpoints `apps/api` exposes on top of it.
-See [Identity](identity.md) for the identity foundation this builds on and [API](api.md) for the
-HTTP transport it is mounted into.
+See [Identity](identity.md) for the identity foundation this builds on, [API](api.md) for the
+HTTP transport it is mounted into, and [ADR
+0013](../architecture/decisions/0013-core-authorization-and-owner-bootstrap.md) for the durable
+architectural decisions this page describes in more implementation detail.
 
 ## What this is, and is not
 

docs/development/repository-workflow.md

@@ -106,8 +106,9 @@ Data definitions
   ✓ Schemas validated
     0 modules · 0 tables
   ✓ Migrations validated
-    1 migration · checksums valid
+    2 migrations · checksums valid
     core:0000_identity_core_tables · f8f2086ef06f
+    core:0001_authorization_core_tables · 830e1fbc26d0
 
 PostgreSQL
   ○ Connection check skipped