refactor(iam): pluggable IAM regime via authenticate/authorise contract (#853)

The gateway no longer holds any policy state — capability sets, role
definitions, workspace scope rules.  Per the IAM contract it asks the
regime "may this identity perform this capability on this resource?"
per request.  That moves the OSS role-based regime entirely into
iam-svc, which can be replaced (SSO, ABAC, ReBAC) without changing
the gateway, the wire protocol, or backend services.

Contract:
- authenticate(credential) -> Identity (handle, workspace,
  principal_id, source).  No roles, claims, or policy state surface
  to the gateway.
- authorise(identity, capability, resource, parameters) -> (allow,
  ttl).  Cached per-decision (regime TTL clamped above; fail-closed
  on regime errors).
- authorise_many available as a fan-out variant.

Operation registry drives every authorisation decision:
- /api/v1/iam -> IamEndpoint, looks up bare op name (create-user,
  list-workspaces, ...).
- /api/v1/{kind} -> RegistryRoutedVariableEndpoint, <kind>:<op>
  (config:get, flow:list-blueprints, librarian:add-document, ...).
- /api/v1/flow/{flow}/service/{kind} -> flow-service:<kind>.
- /api/v1/flow/{flow}/{import,export}/{kind} ->
  flow-{import,export}:<kind>.
- WS Mux per-frame -> flow-service:<kind>; closes a gap where
  authenticated users could hit any service kind.
85 operations registered across the surface.

JWT carries identity only — sub + workspace.  The roles claim is gone;
the gateway never reads policy state from a credential.

The three coarse *_KIND_CAPABILITY maps are removed.  The registry is
the only source of truth for the capability + resource shape of an
operation.  Tests migrated to the new Identity shape and to
authorise()-mocked auth doubles.

Specs updated: docs/tech-specs/iam-contract.md (Identity surface,
caching, registry-naming conventions), iam.md (JWT shape, gateway
flow, role section reframed as OSS-regime detail), iam-protocol.md
(positioned as one implementation of the contract).

tests/unit/test_gateway/test_endpoint_manager.py

@@ -73,14 +73,16 @@ class TestEndpointManager:
             prometheus_url="http://test:9090"
         )
         
-        # Each dispatcher factory is invoked exactly once during
-        # construction — one per endpoint that needs a dedicated
-        # wire.  dispatch_auth_iam is the dedicated factory for the
-        # AuthEndpoints forwarder (login / bootstrap /
-        # change-password), distinct from dispatch_global_service
-        # (the generic /api/v1/{kind} route).
+        # Each dispatcher factory is invoked once per endpoint that
+        # needs a dedicated wire.  dispatch_auth_iam is shared by
+        # two endpoints — AuthEndpoints (login / bootstrap /
+        # change-password) and IamEndpoint (registry-driven
+        # /api/v1/iam) — so it's expected to be called twice.
+        # Both forwarders pin the dispatcher to kind=iam and reuse
+        # the same factory; they're distinct from
+        # dispatch_global_service (the generic /api/v1/{kind} route).
         mock_dispatcher_manager.dispatch_global_service.assert_called_once()
-        mock_dispatcher_manager.dispatch_auth_iam.assert_called_once()
+        assert mock_dispatcher_manager.dispatch_auth_iam.call_count == 2
         mock_dispatcher_manager.dispatch_socket.assert_called_once()
         mock_dispatcher_manager.dispatch_flow_service.assert_called_once()
         mock_dispatcher_manager.dispatch_flow_import.assert_called_once()