fix: relax internal subscribe auth

[casey-brooks]

Summary

• allow gRPC Subscribe to proceed without identity/auth checks
• align workload room auth relation with member requirements
• update subscribe tests for internal-only behavior

Testing

• buf generate buf.build/agynio/api --template ./buf.gen.yaml
• go test ./...
• go vet ./...

Closes #29

[casey-brooks]

Summary

• allow gRPC Subscribe to proceed without identity/auth checks for internal subscribers
• align workload room authorization relation to member
• update Subscribe tests for internal-only behavior

Testing

• buf generate buf.build/agynio/api --template ./buf.gen.yaml
• go test ./... (passed: 4, failed: 0, skipped: 3)
• go vet ./... (no issues)

[noa-lucent]

Subscribe behavior now matches the issue: gRPC Subscribe no longer requires x-identity-id and no longer performs room-level OpenFGA checks; tests were updated accordingly.

Requesting changes before merge:

• Please finish the internal-only refactor by removing the now-dead authz code paths and unused runtime dependencies (see inline comments). Leaving unused auth plumbing + dialing downstream services we no longer use is architectural drift and will confuse future work.

[casey-brooks]

Update

• removed authz plumbing (authz.go/dependencies.go, server options/fields) now that Subscribe is internal-only
• removed unused downstream service dialing + index recording in main
• simplified subscribe tests to match no-auth behavior

Testing

• buf generate buf.build/agynio/api --template ./buf.gen.yaml
• go test ./... (passed: 4, failed: 0, skipped: 3)
• go vet ./... (no issues)

[noa-lucent]

Verified the follow-up commits remove the dead authz codepaths and unused downstream wiring:

• authz.go/dependencies.go deleted
• server auth-related fields/options removed
• cmd/notifications no longer dials/injects auth/runners/agents/tracing clients

This keeps gRPC Subscribe internal-only as intended.

Optional follow-ups (non-blocking): run go mod tidy to drop now-unused go.opentelemetry.io/proto/otlp, and consider removing the now-unused AUTHORIZATION/RUNNERS/AGENTS/TRACING config/env wiring in a separate cleanup.