Add authorization policies to management endpoints #1713

Goal

Require explicit authorization for user, role, client, API scope, API resource, and identity resource management endpoints.

Context

The routes in SecurityService/Endpoints/ManagementEndpoints.cs are mapped without visible endpoint authorization policies.

Acceptance criteria

• Unauthenticated requests receive 401.
• Authenticated callers without the required permission receive 403.
• Policies distinguish at least user management from client/resource management.
• Integration tests cover allowed and denied access for representative endpoints.