[fix][evaluation] enforce authorization on eval-target debug/async-debug, template update, and evaluator delete/draft-update

[topjames666]

What

Fix authorization gaps in the evaluation module's application layer:

1. DebugEvalTarget / AsyncDebugEvalTarget — the authorization call was
   commented out in both the sync and async eval-target debug handlers, so any
   authenticated caller could trigger a debug run against an arbitrary
   workspace_id. Restored the space-level Authorization check
   (ActionDebugEvalTarget / AuthEntityType_Space) on both. (The frontend
   "debug target" feature calls both endpoints depending on sync/async mode, so
   both must be fixed.)

2. UpdateExperimentTemplate — the write path only checked space-level
   read/list permission, allowing a low-privilege member to modify templates
   owned by others. Switched to an object-level edit check
   (AuthorizationWithoutSPI with the template's owner), consistent with
   UpdateExperiment.

3. DeleteEvaluator — authorization relied on the result of an unfiltered
   batch lookup; an empty result silently skipped the auth check and fell
   through to a global-id soft delete. Reworked to use the space-scoped
   GetEvaluator, return EvaluatorNotExistCode when not found, and authorize
   against the resolved object — aligned with UpdateEvaluator.

4. UpdateEvaluatorDraft — the CustomRPC/Agent write gate keyed off the
   client-supplied evaluator_type, while persistence used the server object's
   real type (type confusion): a caller could declare a non-CustomRPC type to
   skip the gate yet still write CustomRPC content. The gate now keys off the
   server-side type, plus a consistency check that rejects a request whose
   declared type does not match the stored object.

Why

Each is an authorization boundary defect: missing (1), downgraded to a weaker
permission (2), auth object vs. write object mismatch (3), or auth decision
driven by client-controllable input (4).

Tests

Added/updated unit tests covering the unauthorized/mismatched paths for all
handlers (permission-denied, not-found rejection, cross-space rejection,
type-mismatch rejection). All evaluation application tests pass:
cd backend && go test -gcflags="all=-N -l" ./modules/evaluation/application/...

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main     #585      +/-   ##
==========================================
+ Coverage   77.44%   77.47%   +0.02%     
==========================================
  Files         678      679       +1     
  Lines       80813    80845      +32     
==========================================
+ Hits        62589    62631      +42     
+ Misses      14491    14484       -7     
+ Partials     3733     3730       -3     

Flag	Coverage Δ
unittests	77.47% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../modules/evaluation/application/eval_target_app.go	93.38% <100.00%> (+0.18%)	⬆️
...nd/modules/evaluation/application/evaluator_app.go	90.43% <100.00%> (+0.11%)	⬆️
...d/modules/evaluation/application/experiment_app.go	83.22% <100.00%> (+0.14%)	⬆️

... and 6 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1b9b2a8...1e95382. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.