2781: Follow up to finish updates to switch over to using the snapshot for auth

[bbartman]

Description:

control-plane: remove the remaining internal.user_roles() authorization call sites

Follows #3155, which moved publication and discover authorization onto the in-memory Snapshot and left five internal.user_roles() call sites for follow-up. This removes all of them, by migration or by deletion.

Evolutions: resolve_specs no longer filters by user_roles() in SQL. The query becomes a plain fetch (fetch_evolution_specs) and authorization moves to an in-process wrapper applying the shared spec-fetch policy: admin required per live spec, authoritative denials suppress the live join (preserving the "was never published" surfacing), and provisional denials surface as the retryable AuthorizationSnapshotStale error. Evolution gains a started_at anchor, threaded through its live-spec fetches in place of hardcoded None. One intentional delta, pinned by test: the Rust grant walk also traverses role grants whose subject is a parent of the held role, which the one-way SQL walk could not reach. The Rust implementation is authoritative over the legacy SQL semantics.

Admin endpoints: create-data-plane and update-l2-reporting replace their raw ops/-admin SQL pre-check with the standard Envelope idiom (evaluate_names_authorization + authorization_outcome), extracted as server::authorize_ops_admin. The request's pinned Snapshot now serves both the pre-check and the ops publication: one request, one authorization view. A denial under a Snapshot which predates the request is now a 307 AuthZRetry rather than an immediate 403; the flow-plane-link unit gains curl -L so a redirect can't read as success.

Storage-mappings directive: deleted rather than migrated. The GraphQL storage-mapping mutations superseded it on 2026-03-16 (the last routine production application), so the agent-side handler, its Directive variant, and user_has_admin_capability are removed — the latter taking with it a loose-direction prefix comparison that let a sub-prefix admin rewrite the whole tenant's mapping. The still-shared persistence helpers move out of directives/ to control-plane-api/src/storage_mappings.rs. That authorization boundary is now pinned on the GraphQL path instead: sub-prefix and attenuated raw-admin shapes are denied.

The spec-fetch policy shared by get_live_specs, get_connected_live_specs, and evolutions::resolve_specs is centralized as
Snapshot::spec_fetch_authorization so the three enforcement points cannot drift, and the per-module test Snapshot helpers consolidate into a shared test_support module.

The agent crate now sets recursion_limit = 256: laying out the publication pipeline's nested poll future needs a ~130-deep rustc query descent, over the 128 default. Earlier trees compiled only because the since-deleted directive chain happened to pre-compute shared sub-layouts.

Tests: evolutions parity/delta/staleness (sqlx), endpoint denial and 307-retry paths (test_server), GraphQL storage-mapping authorization denials, plus the pre-existing suites: 194/194 control-plane-api, 112/112 agent.

Workflow steps:

(How does one use this feature, and how has it changed)

Documentation links affected:

(list any documentation links that you created, or existing ones that you've identified as needing updates, along with a brief description)

Notes for reviewers:

(anything that might help someone review this PR)