refactor(server): make every route state the authority it demands

[otavio]

What

Every route registration now states what it demands of the caller's role, and a route-table invariant refuses the omission. This closes the last of the three claims a route makes — breadth and anonymity already could not arrive silently, because Unbounded and Anonymous each take a required reason.

It also fixes a reachability bug the audit turned up: POST /api/auth/device and POST /api/auth/user answered 401 to the clients they exist for.

Why

CONTEXT.md already asserted the rule. Authority had no option and no check, so 34 of the community route table's registrations carried no permission and nothing asked why — a reader could not tell a route that genuinely demands none from one whose check merely moved somewhere the route table cannot see.

Closes #7036

Changes

• gateway: three options, because the 34 do not share a reason. RequiresAny declares and installs its guard in one act, so the claim stays evidence rather than description; it exists because DeleteSSHIdentity's rule is two permissions, which Requires cannot spell. PermissionInHandler(reason) and NoPermission(reason) install nothing and record why.
• Declaration: one enumerated Authority plus a Permissions slice, replacing Permission/RequiresPermission. The zero value is a route that stated nothing — the case the invariant exists to see — and one field cannot drift against another.
• route table: unstatedAuthority refuses a route that claims nothing, names an empty permission set, or leaves a reason blank. anonymityDisagreements refuses two mounts of one handler that disagree on whether it needs a credential.
• DeleteSSHIdentity: the two-permission check left the handler body for the mounting line. req.Manage still derives the ownership half, which is a data decision rather than an admission one.
• POST /api/auth/ssh: the handler's doc comment claimed it checks whether an offered key belongs to the namespace. It loads a private key by fingerprint and signs the caller's payload, reading no namespace at all. Corrected alongside its route reason.

Deviations from the issue

Three, all deliberate:

1. The anonymity check is not the one the issue proposed. "A route whose authority claim says it expects no credential" is not derivable — NoPermission does not mean that (GET /api/devices demands a credential and claims it), so that predicate would have fired on ~20 correct routes. The handler-agreement rule is narrower than asked: a first-of-its-kind anonymous route with a unique handler still reads as consistent. It catches the V2-spelling shape, which is the shape that bit us.
2. Two classifications the issue drafted were wrong. GET /api/ssh-approvals/:code and GET /api/devices/login-code/:code were assigned NoPermission on the grounds that the credential carries no role. Both take a user token, and both services resolve the namespace from the code and refuse a non-member — so they claim PermissionInHandler. NoPermission would have been a false claim, which is the failure this change exists to prevent.
3. Authority enum over four booleans, which the issue explicitly left as an implementation choice.

Testing

No caller observes a permission change. RequiresAny(SSHIdentityAdd, SSHIdentityManage) is exactly the guard deleted from the handler body, since no role holds Manage without Add. One ordering shifts: the 403 now precedes the bind, so an unpermitted caller sending a malformed body gets 403 where it got 400.

Each new predicate was verified against the real route table by deleting a claim, not only against its known-bad fixture — unstatedAuthority listed all 34 routes on first run, and anonymityDisagreements fired on POST /api/auth/device. Worth re-running that mutation if you want the green run to mean something.

Two things a reviewer should probe rather than take on trust: every NoPermission and PermissionInHandler reason is a claim about what the handler and service actually do, and a wrong one is worse than none. And cloud/'s 32 /admin/api routes are not yet held to this invariant — the vocabulary is built here so their policy is a separate decision (shellhub-io/team#238).

Note this is stacked on refactor/list-query-contract, so CI runs zero checks. Locally: server suite, golangci-lint and go mod tidy all clean.