fix(cloud): insecure mode blocked by unconditional principal project authorizer

[adersonrangel]

📋 Pre-flight Checks

• I have searched existing issues and this is not a duplicate
• I understand this issue needs status:approved before a PR can be opened

📝 Bug Description

Engram Cloud container runs with ENGRAM_CLOUD_INSECURE_NO_AUTH=1 (no auth for local dev) via docker-compose.cloud.yml. However, in cmd/engram/cloud.go the newCloudRuntime function unconditionally adds WithPrincipalProjectAuthorizer, even in insecure mode.

When a request comes in:

1. No authenticator exists (insecure mode) → authenticateRequest allows it (no principal in context)
2. But WithPrincipalProjectAuthorizer is set → authorizeProjectScope tries to get principal from context
3. No principal exists → returns "forbidden: principal is required" (403)

🔄 Steps to Reproduce

1. Clone repository main branch
2. In docker-compose.cloud.yml check ENGRAM_CLOUD_INSECURE_NO_AUTH=1
3. docker compose -f docker-compose.cloud.yml up -d
4. Wait for both postgres and cloud services to be healthy
5. engram cloud config --server http://127.0.0.1:18080
6. engram cloud enroll smoke-project
7. engram sync --cloud --project smoke-project
8. Observe 403: forbidden: principal is required

✅ Expected Behavior

Expected: Requests succeed in insecure mode (no auth required)
Actual: 403 Forbidden

❌ Actual Behavior

Exporting memories for project "smoke-project" to cloud... enrgam: cloud: fetch manifest: status 403: forbidden: principal is required.

Operating System

Linux (Ubuntu/Debian)

Engram Version

1.19.0

Agent / Client

OpenCode

📋 Relevant Logs

Exporting memories for project "smoke-project" to cloud...
enrgam: cloud: fetch manifest: status 403: forbidden: principal is required.

💡 Additional Context

Not token provider and ENGRAM_CLOUD_INSECURE_NO_AUTH=1