Add explicit none, api_key, and jwt runtime auth modes, including a generic no-auth provider.

Move controls, bindings, policies, agents, and evaluation storage lookups onto principal namespace scoping.

Cover auth mode selection and principal namespace isolation with server tests.

…stream

The default forward set (X-API-Key, Authorization, Cookie) only covers
credential headers Agent Control itself reads. Deployments whose
upstream authenticates against a different header name (e.g., a
deployer-specific API-key header) had no way to surface that
credential through HttpUpstreamAuthProvider — the inbound header
reached AC but never crossed the upstream call.

Add an extra_forward_headers config field on HttpUpstreamConfig
(defaulting to the empty tuple) that operators populate via the new
AGENT_CONTROL_AUTH_UPSTREAM_EXTRA_FORWARD_HEADERS env var (comma-
separated). The provider's _forward_headers iterates over the union
of the default set and the extras, deduplicating case-insensitively
so a duplicate name (cross-set or within extras) does not produce two
copies on the wire.

Tests:
- forwards a configured extra header alongside defaults
- default forward set unchanged when extras are empty
- extras dedupe against defaults case-insensitively
- _parse_extra_forward_headers parametric: None / empty / single /
  multiple / whitespace / empty-entries / case-folded duplicates
- configure_auth_from_env threads the parsed tuple onto the provider

Lint clean, typecheck clean, full server suite (747) green.