authz

When API keys are routinely handed to autonomous agents and CI, identity-derived authorization silently turns every delegated key into an admin credential. Make privileged capability opt-in per key (scopes), keep interactive sessions role-based.

An admin 'approve' endpoint can exist, be tested, and still do nothing — verify the admission gate actually reads the approved status before porting UI onto it.