feat(router): configure generic scope matching

[first-assist]

Summary

• add a strict, generic scopeMatcher file section while preserving exact matching when omitted
• expose hierarchical separator, wildcard, universal-wildcard, superScopes, exactOnlyScopes, and exactOnlyScopePatterns options through the optional auth-agql adapter
• apply one configured matcher to fixed and rendered requirements
• align the direct-host coexistence fixture and current bridge guidance with agql-auth 0.16 so consumers resolve one auth type universe

Consumer neutrality

This serves consumers beyond GEMA by letting any router deployment select exact compatibility or its own hierarchical authorization policy without consumer-specific code. No consumer identifiers or policies are embedded upstream.

Before opening and updating this PR, the complete diff was scanned case-insensitively for gema and separately against GEMA's catalogue scope strings; both scans returned zero matches.

Verification

• no-default-features tests: 59 unit + 1 binary smoke
• auth-agql tests: 60 unit + 1 binary smoke
• warnings-denied clippy in both modes
• warnings/missing-docs-denied rustdoc with auth-agql
• documentation, generated inventory, package release-policy, and diff checks
• direct-host coexistence fixture pin and lock aligned for the required single auth type universe

Documentation impact

• Documentation updated
• No documentation impact

Updated the router README, configuration reference, example, changelog, and migration guide; the current ORM bridge guide, workspace inventory, and package handoff notes now describe the aligned external auth revision. No descriptor, GraphQL schema, token, database, or stored-data migration is required.

The router package is bumped to 0.2.0. This PR depends on Dastari/agql-auth#3 and temporarily pins its reviewed head revision; that pin will be replaced with the merged full revision before this PR is merged.