Scope enforcement in authz middleware — gate routes by required scope

[yacosta738]

Goal

Make the authz middleware reject requests when the authenticated API key does
not hold the required scope for the route being accessed.

Background

The middleware currently stamps scopes onto trusted headers but never checks
whether the key's scopes satisfy the requirements of the route. A key with
chat:read can currently call providers:write routes without restriction.

Depends on #83. Closes part of #46.

Acceptance Criteria

• A required_scope(route_class, path) function maps routes to their
  required scope
• client_api_policy returns HTTP 403 INSUFFICIENT_SCOPE when the
  authenticated key lacks the required scope
• admin scope grants access to all routes (superset semantics)
• Public routes and management routes (session-authenticated) are unaffected
• Integration tests cover: correct scope allowed, wrong scope rejected,
  admin scope allowed on any route

Scope

In scope: transport-axum/src/authz.rs

Out of scope: allowed_models/allowed_providers (separate issue)

Verification

cargo test -p transport-axum

[linear-code]

DALLAY-397