Configure exact-only super-scope policy in the router

[first-assist]

Summary

• Advance the optional authorization adapter to agql-auth 0.19.0 at reviewed merged revision 1d2e9fe2e1576105212a7b340a11abf8cad0382d.
• Add strict hierarchical scopeMatcher.allowSuperScopesForExactOnly configuration, disabled by default. When enabled, exact membership in caller-supplied superScopes can satisfy exact-only requirements while wildcard-derived, similar, and unrelated grants remain denied.
• Bump graphql-orm-router to 0.5.0 and refresh the root and coexistence-fixture locks, including the fixture's current path-package versions.

Verification

• Formatting and committed-diff checks.
• Focused configuration truth-table and strict parsing tests.
• Full router-protocol tests and router tests with default and auth-agql feature sets.
• Core authorization assurance and backend coexistence fixture tests.
• Warnings-denied Clippy and Rustdoc for affected packages and feature sets.
• Locked metadata and dependency-tree verification of one exact agql-auth 0.19.0 source at the merged revision.
• Documentation, generated inventory, dependency-boundary, release-state, package-release, release-manifest, and SemVer gates.
• Restricted-vocabulary scan of the committed diff and pull-request metadata.

Documentation impact

Check exactly one option and explain the result.

• Documentation updated
• No documentation impact

Explanation: The router README, configuration reference, changelog, migration guide, and generated workspace inventory document the additive opt-in and compatibility default.