fix(auth): publish verified proofs at the commit boundary

[marcus-pousette]

Problem

Local authorization happens before a database write commits. verifyOps previously published proof material immediately, so a failed or retried local proposal could leave durable proof state for an operation that never committed.

What changes

• verifyOps validates operations without publishing proof material.
• onVerifiedOps publishes accepted proof material to the in-memory cache and optional store.
• Remote sync keeps its proof-first order: verify, publish proof, then apply the batch.
• Local backends can use fix(auth): expose local proofs for atomic backend commits #187's proof handoff and commit the operation and proof in one database transaction.
• The local signing cache remains available for forwarding committed operations without signing again.

Fast paths

• Configurations without an external proof store perform no new durable work.
• Remote sync still performs one proof publication per verified batch.
• Local signing retains its in-memory cache.

Tests

• repeated local proposal validation has no proof-store side effect
• onVerifiedOps publishes the accepted proof exactly once
• remote verified-batch publication remains supported

Stack

Stacked on #187. SQLite and PostgreSQL transaction implementations follow from this commit boundary.