fix(objectql): formula fields and CEL defaults answer current_user.can() from the resolved permission map

applyFormulaPlan (find, findOne, write echo) and applyFieldDefaults now pass
the acting subject's effective object-permission map, resolved at most once
per operation through the registered resolver and shared with the option
gates. No resolver passes no map; a failed resolution reads null with a warn
on a read and refuses the write for a row whose can() default needed it.

Claude-Session: https://claude.ai/code/session_01Bvd69VPa6puiNzzPUroDBx
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude