fix(auth): fail closed on unsafe scoped op-log projection

[marcus-pousette]

Problem

Sync filters reconcile historical operations, but the subtree evaluator only sees current materialized ancestry. A node can enter a private subtree and later re-enter readable state; filtering from current membership can then reveal its private destination or payload history.

Simply omitting a required operation is also unsafe because it changes the selected causal op set and can leave the receiver stale.

What changes

• The reference COSE/CWT auth implementation requires document-wide read_structure for both Filter.all and Filter.children.
• Payload updates, payload clears, and payload-bearing inserts additionally require document-wide read_payload.
• Unsafe projections reject as a whole instead of trying to redact individual historical operations.
• Filters may still reduce reconciliation work; they no longer reduce the authorization scope.
• Custom SyncAuth implementations remain free to provide a different authenticated projection format.
• Obsolete current-membership projection tests are replaced with fail-closed coverage.

Fast paths

• Structure-only batches need only read_structure.
• Peers with document-wide grants keep the direct allow path.
• Backend children filtering and the existing reconciliation optimizations remain available.

Tests

• private destinations and history remain hidden after a node re-enters readable state
• structure-only projections work without payload authority
• payload updates, clears, and inline payload inserts require read_payload
• playground scoped projections fail closed

Stack

Stacked on #189.