feat(auth): add versioned authorization context contract

[cea-block]

Why

Authorization providers and protected transports need one immutable, provider-neutral context that preserves the verified actor, optional federated principal, binding state, delegation, transport, and time bounds used for a decision.

What

• Add a versioned authorization context finalized from server-verified evidence
• Keep the authenticated Nostr actor distinct from an optional issuer-qualified federated principal
• Represent active bindings with stable identifiers, positive versions, provenance, and authoritative lifecycle results
• Keep direct authorization, delegated-owner authorization, and owner admission distinct
• Add stable decision reasons and redacted diagnostics
• Rename the existing relay connection context so it remains distinct from the new authorization contract

Review guide

• The main review surface is the buzz-auth authorization-context contract and its invariant tests
• Relay changes are limited to adopting the distinct connection-context name and compile-time seams
• This PR does not add persistence, migrations, configuration, provider adapters, or new runtime authorization behavior

Risk assessment

Low. This PR adds a contract and type-level integration seams without activating new authorization behavior.

Testing

• Authorization-context construction and invariant tests
• Negative cases for domain, transport, principal, key, delegation, attestation, lifecycle, and time mismatches
• Formatting, linting, and hosted repository checks

References

• Depends on feat(relay): add relay-verified identity binding #1476
• Authorization specification: NIP-FI: Federated Identity Authorization (spec + formal model) #1485 and docs(nips): complete NIP-FI authorization draft #3726