feat(auth): filter query inputs by token scopes

What does this MR do and why?

Add optional token scopes to the existing compiler security pass. The pass filters query inputs before counts, joins, and paths can use them. Existing server requests keep these scopes unset.

This is the compiler prerequisite extracted from !2409 (closed). It contains the filters and their direct integration tests. Token authentication and Rails callbacks stay in !2409 (closed).

Request flow

The complete stack uses this flow. This MR implements step 5 in the compiler; it does not activate token checks in the server.

1. Rails authenticates the token and sends Orbit a signed JWT with token_authorization_required: true. The JWT contains no raw token or grants.
2. Orbit identifies the required permissions and asks Rails to check them through Workhorse.
3. Workhorse forwards the original credentials to the internal Rails callback.
4. Rails checks the token’s saved grants and returns allow/deny decisions for each permission and resource.
5. Orbit uses those decisions to filter query inputs. Final resource checks also enforce the user’s existing abilities.

Related Issues

• Depends on protocol MR !2408.
• Prepares server MR !2409.
• Relates to token issue 992.
• Relates to hidden query inputs, issue 347.
• The full stack uses the stream pattern from GitLab MR !229394.

Testing

Local checks pass: 692 unit tests, 163 integration tests, and three ClickHouse suites. The ClickHouse suites cover existing behavior, token permissions, and scan cost. Pipeline 2825036173 passes. Workspace Clippy passes with all features and targets.

Performance Analysis

For a pinned neighbors query, extra token reads stay below the 8,192-row test budget. With 10,000 unrelated definitions, extra reads are 1,830 rows. With 110,000 unrelated definitions, extra reads are 1,478 rows. Unbounded queries still need full membership checks.

• This merge request does not introduce any performance regression. Token filters add work when enabled; existing server requests leave them unset.

Agent context

The split adds 792 lines and removes 74 lines across ten files. The compiler code comes from the validated server branch. Most of this prerequisite concerns SQL filters and their regression tests.

No JWT, catalog lookup, callback, graph-status, schema, or ontology permission change is included here. The internal compiler flag cannot be set through query JSON.

Deploy the full server fix before Rails starts sending token requests. The compiler prerequisite alone does not enforce token permissions at the API.