feat(router): expand signed authorization roles

[first-assist]

Outcome

Adds an opt-in, provider-neutral signed role-to-scope catalogue to graphql-orm-router. A host can configure authentication.roleScopeCatalogue; the router verifies issuer/audience/purpose/payload/lifetime against its existing JWKS trust, caches a bounded snapshot, expands validated token roles, unions direct scopes, and fails role-bearing requests closed when expansion state is unavailable or stale.

This serves consumers beyond any one deployment: any JWT issuer can supply its own role IDs, scope values, catalogue URL, signing key, audience, cache policy, and matcher policy. The upstream crates contain no consumer values or defaults.

Also aligns the public agql-auth type universe in the graphql-orm auth-agql feature, graphql-orm-ai re-exports, and the backend-coexistence consumer fixture to merged agql-auth 0.17.0. Versions move to graphql-orm/graphql-orm-macros 0.25.0, graphql-orm-ai 0.90.0, and router 0.3.0.

Documentation impact

• Documentation updated
• No documentation impact

Updates root/router/AI changelogs, migration guides, README/version inventory, router configuration reference/example, and auth bridge references. Omission is compatibility-preserving; adoption order and rollback are documented.

Verification

• router tests: 65 + binary smoke with auth-agql; 60 + binary smoke without it
• warnings-denied clippy: router in both feature modes
• warnings-denied rustdoc: router in both feature modes
• graphql-orm --lib --features sqlite,auth-agql: 34 passed
• graphql-orm-ai --lib: 247 passed
• backend-coexistence fixture: one exact agql-auth 0.17.0 universe
• warnings-denied clippy: graphql-orm affected feature set and graphql-orm-ai --lib
• documentation checker, formatting, and git diff --check: passed
• neutrality grep of the complete diff for gema (case-insensitive) and consumer scope/host strings: empty