fix(security): prevent external superuser assertions - #180

Summary

• centralize canonicalization of roles asserted by JWT and OIDC identities
• prevent external claims and claim mappings from granting database-owned superuser authority while preserving ordinary roles and database grants
• reject new unsafe OIDC mappings and sanitize legacy mappings during authentication
• document the external-authority boundary and expand transport/provider regression coverage

Validation

• focused JWT, JWKS, OIDC, AuthContext, and HTTP authentication suites
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all --check
• git diff --check