fix(auth): expose local proofs for atomic backend commits

[marcus-pousette]

Problem

A storage backend needs the verified signature and proof reference before committing a local operation if both records are to share one transaction.

There is also an integrity trap: the v0 operation reference identifies the document and operation id, but not the operation body. A retained proof must not be reused for a different body with the same id.

What changes

• Add the backend-neutral LocalWriteAuthProof shape: signature plus optional proof reference.
• Add an optional side-effect-free localOpProofs handoff to local auth sessions.
• Return detached proof bytes aligned with the operations that were authorized.
• Cryptographically verify retained proof material against the exact operation before reuse.
• Fail closed for a non-local operation when no exact valid retained proof exists.

This PR exposes the handoff; the SQLite and PostgreSQL PRs later perform the atomic database commit.

Fast paths

• Proof bytes already produced during local authorization are reused without re-signing.
• Valid exact retained proofs keep the restart/forwarding path.
• The hook is optional, so unauthenticated and custom sessions are unchanged.
• Proof extraction performs no durable I/O.

Tests

• auth sessions return detached, validated proof bytes
• malformed or misaligned authorization is rejected
• restart reuses a retained proof only for the exact signed operation
• conflicting bodies with the same operation id fail closed

Stack

Stacked on #191. This is the proof-handoff foundation for #192, #194, #195, and #196.

[marcus-pousette]

Temporarily marked draft while rebasing this proof-handoff foundation off the superseded #182/#183 branches and onto the lean #188–#191 auth stack. The proof contract/exact-body validation remain; preWriteState/scoped-write dependencies and obsolete tests are being removed before it is marked ready again.