Cerbos integration

Cerbos is a policy decision point: authorization rules live in YAML resource and principal policies, and the running server answers access questions against them. This catalog entry covers both of its HTTP surfaces. The decision surface asks whether a principal may perform given actions on given resource instances, returning one ALLOW or DENY per action with the policy and rule that decided it, and asks for a query plan instead, the filter expression a database query would need to return only the rows that principal may act on. The administration surface adds or updates policies and schemas, reads them back by id, lists the policies and schemas the store holds, inspects policies to see the actions, variables and derived roles they define, disables and re-enables policies, deletes policies and schemas outright, reloads the policy store from disk or from its database, and purges superseded store revisions. The host is part of the credential because every install is its own deployment: point it at the Cerbos HTTP listener (port 3592 by default). Authentication is HTTP Basic with the username and password configured under the server's admin API credentials; the decision endpoints themselves are normally unauthenticated, and the administration endpoints answer only when the admin API is enabled on that server.