quest(m1/auth): move peer grants to the P2P line

[kixelated]

Follow-up to the 2026-09-30 audit (#4589) for the auth line.

• Moves quest/m1/auth/peer-grant.md to quest/m2/p2p/peer-grant.md. P2P signaling is its only consumer, so it becomes a P2P child ranked before signal.md (which already required it) and leaves the auth line's Required. It now requires the auth README instead of relay-refresh.md, since relay tokens only reach main when the line lands.
• Auth README: the "no prefix-only AUTH_OK" rule now covers lite only. IETF AUTH_OK carries namespace prefixes and answers NOT_SUPPORTED for anything else (drafts/draft-lcurley-moq-auth.md Prefixes, rs/moq-net/src/ietf/auth.rs encode_prefixes).
• Auth README: Connection::auth() is the connection-owned handle that relay-refresh.md describes, replacing "the live session's auth handle".

Public API / wire: none (quest files only).

Decisions

Connection handle wording (README vs relay-refresh.md)

• ✅ Connection-owned: the handle outlives sessions and re-presents tokens on reconnect
• Live session's handle: forwards to the current Session's auth::Handle

Sequencing with #4589

• ✅ (user merged quest: apply the 2026-09-30 audit #4589 first) Merge main into the line, then this PR against the line
• Commit onto quest: apply the 2026-09-30 audit #4589
• Stacked PR on main

Peer grants placement (decided by the maintainer before planning): move to quest/m2/p2p/peer-grant.md, required by p2p/signal.md, out of the auth line.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T14:39:10.631248Z	8ad7606	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

MERGE (head 8ad7606ce56d4b835909f23815f1f6699ec10e7d)

Quest-only follow-up to #4589: moves peer-grant.md onto the P2P line, drops it from auth Required, and fixes two auth README claims against the auth-line code/docs.

Claims checked

• IETF AUTH_OK prefixes / NOT_SUPPORTED — matches drafts/draft-lcurley-moq-auth.md §Prefixes and rs/moq-net/src/ietf/auth.rs (encode_prefixes → EncodeError::Unsupported → AUTH_ERROR NOT_SUPPORTED). Lite-vs-IETF split in the README is accurate.
• Connection::auth() connection-owned — matches quest/m1/auth/relay-refresh.md (handle outlives sessions, re-presents tokens on reconnect).
• Link graph — old /quest/m1/auth/peer-grant.md refs updated in auth README, P2P README, and signal.md; rename lands the file under quest/m2/p2p/; P2P Required ranks peer grants before signal.md (which already required it). No gate cycle: auth no longer Requires peer grants; peer grants Require the auth line README.

CI: Check + Test green.

Non-blocking

1. quest/m1/auth/README.md Goal — link text says “P2P” but targets /quest/m2/p2p/peer-grant.md (the child), not the P2P README. Prefer “peer grants” as the label, or point “P2P” at /quest/m2/p2p/README.md.
2. quest/m2/p2p/peer-grant.md Plan still deep-links issuance to relay-refresh.md while Required only gates on the auth README. Fine if intentional (mechanism vs sequencing); otherwise align the Plan wording with the new Required.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 8ad7606

No actionable bugs found in the four-file diff.

Direction: keep this focused correction. Moving peer grants to their sole P2P consumer removes an unnecessary auth-line dependency; waiting for the complete auth line preserves landing order without introducing a dependency cycle. The IETF subtree-only AUTH_OK wording matches the existing codec and draft, and the connection-owned handle matches relay-refresh's reconnect contract. No extra abstraction is needed.

Verification: inspected all changed files, the auth/P2P prerequisites, rs/moq-net/src/ietf/auth.rs and the auth draft; checked changed local links against the exact head tree. Public API/wire/runtime changes: none. I did not run quest check or just check; quest, just and Nix are unavailable here.

(Written by OpenAI)

[kixelated]

Merging: quest-only follow-up to #4589. Peer grants move to quest/m2/p2p/peer-grant.md (P2P is the only consumer), the auth README scopes the prefix-only AUTH_OK rule to lite, and Connection::auth() is the connection-owned handle from relay-refresh.md. Both decisions confirmed by the maintainer in the planning session; CI green, Codex found nothing.

(Written by Claude Opus 5.5)