Make role catalogue expansion resilient

[first-assist]

Summary

• align the router, ORM auth feature, and AI re-exports on generic agql-auth 0.18 typed authorization-role claims
• make role-scope catalogue loading lazy, stale-while-revalidate, lock-light, and explicit on unknown grants
• support environment-derived URLs, secret request headers, independent signature lifetime/leeway, and configurable retry backoff
• bump affected public crates and update changelogs, migration notes, examples, generated inventory, and reference docs

This is consumer-neutral infrastructure: any issuer can supply typed compact authorization grants and any resource server can resolve a signed catalogue without making that issuer a startup dependency. No consumer-specific identifier or policy appears in the diff.

Verification

• cargo test -p graphql-orm-router --features auth-agql (70 passed + binary smoke)
• cargo test -p graphql-orm-router --no-default-features (60 passed + binary smoke)
• cargo test -p graphql-orm --test backend_coexistence_fixture --no-default-features --features sqlite,auth-agql
• cargo clippy -p graphql-orm-router --features auth-agql -- -D warnings
• cargo clippy -p graphql-orm --no-default-features --features sqlite,auth-agql -- -D warnings
• PostgreSQL and MSSQL graphql-orm auth-agql compile lanes
• cargo clippy -p graphql-orm-ai --lib --no-default-features --features sqlite -- -D warnings
• warnings-denied Rustdoc for router, ORM, and AI
• cargo fmt --all -- --check
• documentation and generated-inventory checks
• dependency trees resolve one agql-auth 0.18.0 revision
• neutrality grep of the diff for consumer identifiers/policy strings: empty

The full core test lane reaches one pre-existing trybuild compiler-wording mismatch in retention_wrong_entity.stderr; the changed auth tests and the complete backend-coexistence fixture pass, and this branch does not touch retention diagnostics.

Documentation impact

Updated root and crate changelogs, migration guides, configuration/operations docs, README version surfaces, backend/auth references, and the generated package inventory.

• Documentation updated