feat(rate): host private Morris authority

[d-sorgcodexagent]

Summary

• host the existing Morris job router behind an authenticated, loopback-only FastAPI authority
• launch it on a child-owned ephemeral IPv4 socket and inject a server-only same-origin Vite proxy
• guarantee bounded graceful shutdown, exact registry ownership, cleanup under Ctrl-C/setup failures, and sanitized no-store API errors
• keep static builds inspect-only and preserve the optional FastAPI/Uvicorn dependency boundary

Stack

• Base: codex/4142-morris-authority-bridge / feat(rate): add Morris authority bridge #4397
• Exact parent: 3c95dcaf88c4a0eacc747b48678e1f5c225f12ec
• Exact head: 4986b6cfe5132cd67fb7ad4b13b9a5f0208f1500

Validation

• 62 focused Python authority/lifecycle/shared-launcher tests
• real child process: authenticated readiness, graceful return code 0, closed pipe
• adversarial cleanup tests preserve original Ctrl-C/setup exceptions while attempting all cleanup once
• 20 focused TypeScript proxy/client tests
• Ruff format/check, scoped MyPy, TS type-check, zero-warning ESLint
• Vite production build and private-token bundle scan
• detect-secrets, optional-import boundary, dependency lock, minimum-test, diff, ancestry, and 500-LOC gates
• independent exact-commit review: GO

Deliberate boundaries

• no PyQt or React Morris presentation/polling controls in this PR
• no persistence/export implementation in this PR
• no static/deployed Python authority; the static bundle remains inspect-only without the local companion
• no UpstreamDrift consumer or epic-completion claim

Refs #4142