feat(managementapi): gate the evaluator on IAM/GLAZ part 4/4 (S09 Enforcement plan: 17/20)

📚 Stacked MRs

This step is split into 4 stacked MRs to keep each within the review size limit (≈800 ideal). Each part targets the previous one (part 1 targets main) and the stack is reviewed and merged bottom-up. Part 4 of 4 of the S09 enforcement plan — Step 17: Management enforcement at the slugMiddleware seam, per S09 (authorization).

🔐 What this MR does

Turns enforcement on: wires the IAM/GLAZ-backed decision evaluator into the management surface, replacing part 1's unconditional allow-all wiring.

• Mirrors the OCI gate: authz.NewEvaluator(iam, glaz, read_repository) when both clients are configured, the explicit allow-all value otherwise, with a boot log naming the management surface either way. The fail-closed boot posture that retires the allow-all value lands with the plan's final step.
• read_repository is the management masking action: a denied write's follow-up existence check runs as a read, pinned by the integration masking test.
• Integration tests cover the gate table (both clients, one, neither) and the masking-action pin; the pre-existing wiring integration suites adopt the widened wireManagementAPI signature.

🧪 e2e scenarios

No catalog under docs/testing/ covers the management API, so no scenario is added or affected; the enforcement contract is pinned by this stack's handler-level suites.

Related to #859 (closed)

Stacked MRs (review/merge bottom-up)

• feat(managementapi): enforce route bindings par... (!2139 - merged) • David Fernandez • 19.4
• feat(managementapi): enforce the repository-sco... (!2140 - merged) • David Fernandez • 19.4
• test(managementapi): binding enforcement suite ... (!2141 - merged) • David Fernandez • 19.4
• feat(managementapi): gate the evaluator on IAM/... (!2142 - merged) • David Fernandez • 19.4 👈