fix(authz): expose placeholder context in Cedar evaluations

[rrrodzilla]

Schema preflights evaluate custom Cedar policies against a placeholder containing type defaults for required attributes. Policies and denial logs previously lacked an explicit signal that these values were synthetic, so an attribute-dependent forbid could deny a collection or point-read preflight without a useful explanation.

Application and field actions now require Boolean context.resource_is_placeholder. The authorization engine sets it from the presence of a concrete resource; field checks set false. Required defaults and the _any UID remain, and custom forbids retain their existing behavior. Decision logs include the marker, actual resource UID, and matched policy IDs; evaluation-error rejection is logged as denial even when Cedar also reports a matching permit.

Document guarded Read permit/forbid patterns, Read preflights on both list and point routes, and the generic Create route's existing lack of a proposed-record authorization check. Manual consumers of the generated Cedar schema must now supply the required context attribute, so the next release needs compatibility and semver review. No version, dependency, or owner-policy changes are included.

Validation: 728 integration tests passed (seven skipped). Eight new tests cover required/optional attributes, real default-like values, unchanged unguarded forbids, conditional permits, missing-context request rejection, field checks, structured denial logs, and HTTP list/point behavior. Independent PostgreSQL acceptance passed eleven pagination/filter cases and visible/hidden point reads with a required Boolean; restoring the unguarded policy preserved its denials, and actual JSON logs identified both scopes and matching policies.

Fixes #155.