Require trusted identity for ontology authority

[witbrock]

What changed

• Require authenticated Flask session identity for the ontology-authority management blueprint.
• Resolve actor provenance at the shared access-control seam while retaining legacy identity headers for compatibility reads.
• Reject header-derived identity at every governed ontology effect boundary, including direct concept/relationship/text HTTP writes.
• Prevent /von/generate and /von/api/session/set_user_concept from promoting a legacy header into signed session or adaptive-turn authority.
• Prevent InternalMCP from classifying header-derived ambient identity as trusted workflow/authentication context.
• Add both-header negative controls and authenticated-session positives across authority, HTTP, session, adaptive, gateway, scope, and stdio paths.

Root cause

PR #371 reused a legacy identity resolver that validates X-User-Concept-ID / X-User-Client-ID as existing people. That was sufficient for historical compatibility reads but not authentication. The new semantic-authority surfaces initially treated that identity as a direct human actor, and two routes could persist it into signed session state.

Impact

A client-supplied identity header can no longer grant, delegate, or exercise semantic ontology authority. Legitimate browser sessions and trusted in-process/workflow/adaptive contexts remain supported.

Validation

• 87 end-to-end boundary tests passed across authority routes, direct HTTP, session setup, /von/generate, InternalMCP, stdio, and scope changes.
• 69 role lifecycle, migration, operator-role, vocabulary, and motivating Tier-3 tests passed.
• Independent bounded audit passed 27/27, 66/66, and 44/44 tranches and found no remaining legacy-header spoof path in this demonstrated class.
• Ruff F/E9, Python byte-compilation, and git diff --check passed.

Jira: JVNAUTOSCI-2632