feat(api): expose governed intelligence resources

[eamirian]

Outcome

Continues ACE 0.8C with the first governed machine interface over the same public resource plane Atrium will consume.

What changed

• adds POST /v1/intelligence/resources/query
• derives product and actor scope only from the verified bearer token
• requires signed observe_read token authority and the current Core grant
• persists an opaque authentication receipt for each request
• reauthenticates and reauthorizes every page; cursors grant no authority
• returns the exact public IntelligenceResourcePageV1Alpha1 contract
• allows historical data cutoffs independent from login time
• keeps query identity stable across authentication receipt refreshes while binding actor, product, grant, and exact selector
• reports authentication-evidence persistence outages as a sanitized 503 rather than an unhandled failure

Verification

• 98 focused API, resource-plane, projection, ownership/runtime, package/schema, kernel, MCP-surface, and auth tests passed
• repository-wide Ruff lint and format checks passed
• exact eleven-tool MCP surface remains unchanged

Boundaries

The route is a thin host adapter over existing authentication receipts, governed-state authority, immutable records, and the public application service. It creates no new auth, persistence, resource, connector, provider, UI, or domain subsystem.