control-plane: Snapshot authorization model and retryable staleness error (1/7)

[bbartman]

What

Split 1 of 4 of #3155 (issue #2781): the foundation layer for moving catalog
authorization out of SQL and onto the in-memory authorization Snapshot.

• validation: adds Error::AuthorizationSnapshotStale { catalog_name } —
  the retryable signal that an authorization denial was evaluated against a
  Snapshot which may not yet reflect a committed grant — and
  is_authz_snapshot_stale() to classify it after anyhow wrapping.
• control-plane-api Snapshot authorization model (server/snapshot.rs):
  • Authorization enum (Authorized / Denied / Stale) with
    ok_or_stale(), which converts a provisional denial into the retryable
    error above.
  • Snapshot::resolve_authorization(), user_authorization(),
    role_authorization() — grant evaluation against the pinned Snapshot,
    classified by whether the Snapshot postdates the operation's freshness
    anchor (taken_after, allowing TEMPORAL_SKEW).
  • Snapshot::spec_capabilities() — in-process replacement for the
    SQL-computed spec_capabilities column, used to render "Available grants
    are:" error messages.
  • STALE_RETRY_WAKE, the re-poll interval used by later splits.
• Rename App::snapshot → App::snapshot_watch, ahead of follow-ups
  where executors pin per-poll Snapshot tokens distinct from the watch.

This PR is purely additive: nothing consumes the new surface yet.

Tests

Unit tests in server/snapshot.rs (no DB required):

• test_resolve_authorization — the three-way classification, including the
  temporal-skew boundary.
• test_spec_capabilities — insta snapshots of capability rendering against
  Snapshot::build_fixture.
• test_taken_after_allows_for_temporal_skew.

Stack

1. → this PR — Snapshot authorization model + retryable staleness error
2. control-plane, agent: move catalog authorization in-process against a pinned Snapshot (2/7) #3342 — move authorization in-process against a pinned Snapshot
3. agent: publications executor defers on stale authorization snapshots (3/7) #3343 — publications executor defers on stale snapshots
4. agent: discovers executor authorizes data-planes via Snapshot and defers on staleness (4/7) #3344 — discovers executor authorizes via Snapshot and defers on staleness

[bbartman]

Note that this combines what was previously two PRs #3155 and #3300