Define auth RBAC verifier contract

[andrei-hasna]

Summary

• add a shared Auth and RBAC Verifier Contract for API, MCP, CLI-token, dashboard, worker, sync/export, and provider webhook surfaces
• define auth context, token types, scope/role model, tenant/workspace/entity boundaries, negative-test matrix, provider webhook rules, and audit requirements
• link the contract from the @hasna/contracts README

Validation

• bun install --frozen-lockfile
• bun run typecheck
• bun test
• bun run build
• marker scan for patch markers
• negative matrix term scan
• staged secrets scan: todos redaction scan --file /tmp/open-contracts-auth-rbac-staged.diff

Task: 74220f07-c9e0-487a-ac32-d6bbe91fdf1a