feat: split auth feature into auth-jwt + auth-rls

Per SMB session REQUEST at bus e1cf316. The combined auth feature
pulled datafusion which triggered xz2 vs liblzma-sys link collision
when combined with lance dep in smb-bridge.

Split:
  auth-jwt  = serde + serde_json only (JWT extraction, no datafusion)
  auth-rls  = auth-jwt + query (RlsRewriter OptimizerRule, needs datafusion)
  auth      = auth-rls (backward compatible)

SMB session can now depend on callcenter[auth-jwt] without pulling
datafusion. F8 unblocked.

https://claude.ai/code/session_01SbYsmmbPf9YQuYbHZN52Zh

Author: claude

crates/lance-graph-callcenter/Cargo.toml

@@ -33,7 +33,9 @@ persist  = ["dep:arrow", "dep:lance"]
 query    = ["dep:datafusion", "dep:arrow"]
 realtime = ["dep:tokio", "dep:tokio-tungstenite", "dep:serde", "dep:serde_json"]
 serve    = ["realtime", "query", "dep:axum", "dep:tower-http"]
-auth     = ["query", "dep:serde", "dep:serde_json"]
+auth-jwt = ["dep:serde", "dep:serde_json"]
+auth-rls = ["auth-jwt", "query"]
+auth     = ["auth-rls"]
 full     = ["persist", "query", "realtime", "serve", "auth"]
 
 [dev-dependencies]

crates/lance-graph-callcenter/src/lib.rs

@@ -81,11 +81,12 @@ pub mod drain;
 // DM-7 — JwtMiddleware + ActorContext → LogicalPlan RLS rewriter ([auth])
 //         UNKNOWN-3 resolved: DataFusion LogicalPlan layer (NOT pgwire).
 //         UNKNOWN-4 resolved: actor_id: String (JWT sub claim flows through unchanged).
-#[cfg(any(feature = "auth", feature = "full"))]
+// DM-7 JWT extraction: ActorContext from JWT token (auth-jwt — no datafusion dep)
+#[cfg(any(feature = "auth-jwt", feature = "auth", feature = "full"))]
 pub mod auth;
 
-// DM-7 — RLS rewriter: DataFusion OptimizerRule injecting tenant/actor predicates ([auth] + [query])
-#[cfg(all(feature = "auth", feature = "query"))]
+// DM-7 RLS rewriter: DataFusion OptimizerRule injecting tenant/actor predicates (auth-rls — pulls datafusion)
+#[cfg(any(feature = "auth-rls", feature = "auth", feature = "full"))]
 pub mod rls;
 
 // DM-8 — PostgRestHandler: query-string → DataFusion SQL → Lance → Arrow ([serve])