feat(casbin): add authorizer adapter

[jmgilman]

Summary

• add a thin Casbin v3 adapter that satisfies authkit.Authorizer
• default to principal ID plus resource/action projection for classic Casbin enforcement
• cover allow, deny, custom projection, error propagation, and a real Casbin enforcer path

Testing

• go test ./...
• moon run root:check
• git diff --check