v0.5.3: refactor: restructure ACL capability schema with backend-keyed map

Migrating ACL capability grants to the new schema

The backends field changed from an array to a map. Per-backend pg and limits now live under each backend key. Top-level limits remains for global per-user constraints. endpoint_limits is removed.

Before

{
  "backends": ["pg-main", "pg-replica"],
  "pg": {
    "databases": {
      "myapp": { "permissions": ["readwrite"] }
    }
  },
  "limits": { "max_conns": 50 },
  "endpoint_limits": {
    "pg-main": { "max_conns": 5 }
  }
}

After

{
  "limits": { "max_conns": 50 },
  "backends": {
    "pg-main": {
      "pg": {
        "databases": {
          "myapp": { "permissions": ["readwrite"] }
        }
      },
      "limits": { "max_conns": 5 }
    },
    "pg-replica": {
      "pg": {
        "databases": {
          "myapp": { "permissions": ["readwrite"] }
        }
      }
    }
  }
}

Steps

1. For each rule, convert "backends": [...] to "backends": { "name": { ... } }
2. Move "pg" into each backend entry that needs it
3. Move "endpoint_limits" entries into the corresponding backend's "limits"
4. Keep top-level "limits" as-is (global per-user limits)
5. Remove the "endpoint_limits" field

Note: The old format is still accepted via backward-compatible deserialization, so migration is not blocking. Update at your convenience.