FAFF-481: headless subscription-seat handle (seat_token_env) + consumer wiring

[alechill]

What

Implements ADR-0092 Decision 4 (FAFF-481): the optional headless seat handle for auth: subscription-seat, so a non-codex subscription seat can authenticate off the interactive harness.

• backends.js — new optional seat_token_env (subscription-seat only); validation admits it on a seat, rejects it on api-key/none, and api_key_env stays a seat-forbidden api-key handle; resolveTokenSource resolves the handle env (else ambient-session); portableMatrixAdmits admits a handle-carrying seat on any harness (the ADR-0076 amendment) while a handle-less anthropic seat stays interactive-only and codex stays any-harness.
• config.js — resolveEngineForLane carries auth + seatTokenEnv onto the resolved record.
• Consumers — engine.js (openai family) and review-call.mjs (openai Bearer + the FAFF-210 anthropic x-api-key adaptor) resolve the token via the resolver's rule; an unset handle → auth-failed pre-call. Codex (engine-codex.js, ambient codex login) unchanged.

Config carries an env var name, never a secret (ADR-0067). Existing handle-absent configs resolve byte-for-byte as today.

Acceptance Criteria

• seat_token_env added (seat-only): schema, normalize, validation — backends.js; selftests green
• resolveTokenSource resolves handle env vs ambient-session — backends.js
• portableMatrixAdmits admits handle-carrying seat headlessly; handle-less anthropic interactive-only; codex unchanged — backends.js
• Consumers use the resolved token in the right header (Bearer / x-api-key); unset handle → auth-failed pre-call — engine.js, review-call.mjs
• Selftests extended; existing configs byte-identical — backends + engine selftests, 151 + 205 targeted module tests pass
• Scope: review-lane anthropic adaptor wired; no native-anthropic engine-call transport (ADR-0076 refusal stands)

Review

Two-phase, both clean: structural (security-sensitive auth review) + adversarial second opinion (NVIDIA GLM-5.2, observation: no findings). Full verdict on FAFF-481.

Validation

• faff backends --selftest, faff engine --selftest — pass
• targeted node --test (backends/engine/config/adversarial) — 356 tests pass
• faff validate-adapters (LINT) — pass
• full UNIT suite — deferred to CI

Closes FAFF-481.