fix(runtime): bind bearer authorization to target scope

[doublewhy]

Problem

A bearer token may be accepted for another target. A supplied but invalid or revoked token may fall back to weaker actor-header authentication. That violates API-404's target-bound, fail-closed access rule.

Done when

• Authenticate once and check bearer state and target scope together.
• Correct-target tokens work. Cross-target, unknown, and revoked tokens fail without actor fallback, even when an actor header is present.
• Actor-only authentication still works when no bearer token was supplied.
• Tests cover each case and docs explain credential precedence and bearer limits.

Use RFC 6750 bearer failures and RFC 8725 audience guidance. Parent: #8.