Replace authorization activation preflight

[cbusillo]

Summary

• replace the local-admin bearer activation preflight with a signed browser-session self-check
• return only the fixed policy-administration decision, hour-bounded evaluation time, keyed opaque policy generation, and trace ID
• remove the caller-selected GitHub ID/session lookup/CLI/agent-contract path and drop its now-unused database index
• update service/operations/authority/records docs and regenerate public contracts

Safety

• rejects every Authorization header and all request bodies/query parameters
• requires a valid, unexpired, claims-current signed session but no separate diagnostic grant
• re-derives role from exactly one active DB policy and ignores persisted session role
• performs no session renewal or durable write; all success/error paths are Cache-Control: no-store
• introduces no authorization grant, workflow authority, or credential workaround

Validation

• uv run --extra dev launchplane ci unittest-shard local (3,081 targets)
• uv run --extra dev mypy control_plane tests
• changed-file Ruff lint and format checks
• pnpm --dir frontend validate
• uv run launchplane service audit-config-authority --control-plane-root .
• focused activation-preflight, schema migration, Postgres compatibility, docs, agent-contract, and browser-boundary tests
• Opus and Gemini final security reviews: APPROVE
• JetBrains changed-files inspection rerun: the introduced migration duplicate warning was fixed; remaining findings are pre-existing warnings in large touched files outside changed lines

Refs #2221