feat(provisioning): add external provisioner service principal flow

[onutc]

TL;DR

This adds the first production-ready external provisioning path to Spritz. Service principals can now create spritzes for a human owner under strict policy, but they cannot manage or access those spritzes afterward.

Summary

• add service-principal auth fields, scopes, and create-only authorization for external provisioners
• implement preset-first provisioning, owner assignment, idempotency, audit metadata, canonical access URL responses, and centralized lifetime defaults/limits
• extend spz with bearer-token machine auth and provisioner create flags, and add lifecycle/activity tracking plus operator status support

Review focus

• authorization boundaries between human, service, and admin principals
• create-time policy enforcement, idempotency replay, and owner immutability assumptions
• lifecycle expiry calculation and activity updates shared between API and controller

Validation

• cd /Users/onur/repos/spritz/api && go test ./...
• cd /Users/onur/repos/spritz/operator && go test ./...
• cd /Users/onur/repos/spritz/cli && pnpm test
• cd /Users/onur/repos/spritz && ./scripts/verify-helm.sh && ./scripts/sync-crd.sh --check && npx -y @simpledoc/simpledoc check
• smoke: cd /Users/onur/repos/spritz/api && go test -count=1 -run 'TestCreateSpritzAllowsProvisionerToAssignOwnerOnce|TestCreateSpritzReplaysIdempotentProvisionerRequest|TestCreateSpritzRejectsIdempotentProvisionerPayloadMismatch|TestListSpritzesRejectsServicePrincipal|TestDeleteSpritzRejectsServicePrincipal|TestAuthMiddlewareSetsPrincipalTypeAndScopes'
• smoke: cd /Users/onur/repos/spritz/cli && node --test --import tsx test/provisioner-create.test.ts
• local review: cd /Users/onur/repos/spritz && codex review --uncommitted (no findings emitted before the review session idled)