control-plane-api: capability-mask Authority extractor

[bbartman]

Part of #3376 (task 3a). Stacked on #3397 (stack 2); review only the last three commits.

Introduces Authority<R: Requirement>, the extractor which will carry capability-mask context through the request path:

• Requirement declares a route’s compile-time authorization precondition: REQUIRED, a slice of CapabilityBundles — the same vocabulary the capability_mask claim speaks, converted to capability bits at evaluation via capabilities() (a fast-fail necessary condition on the mask only — never a substitute for walk enforcement) and REQUIRE_UNMASKED, which keys on the capability_mask claim's presence, never the mask's value.
• A capability shortfall rejects at extraction with a structured 403 (Forbidden) naming the missing PascalCase capabilities — the stable contract a client parses to drive an upgrade_token re-mint. Refusing masked bearers outright yields unmasked_token_required, which no re-mint can remedy.
• NoRequirement (the default) stays Maybe-shaped: unauthenticated requests extract successfully and Envelope::claims() remains the lazy per-callsite identity gate.
• Call sites decompose Authority { envelope, mask, .. } structurally, like axum's State. The PhantomData<R> field is private, so a requirement-bearing Authority is unforgeable proof that R was evaluated; from_envelope is the assembly path for non-HTTP callers (GraphQL test harnesses).

Zero behavior change: no handler extracts Authority yet. The mechanical Envelope → Authority migration and live mask threading through the ALL_CAPABILITIES call sites follow in stack 3b.

Tests cover evaluate_requirement directly and drive Authority<R> as a real extractor over an axum router, pinning the exact status and body of every refusal, mask-claim carry-through (including unrecognized names and the empty mask), and inherited Envelope authentication (aud, expiry, malformed bearers).