feat: add governed Cognitum Spaces activation

[ruvnet]

Outcome

Adds a first-class, read-only Cognitum Spaces activation path to RuView:

• explicit login --spaces consent for spaces:read;
• bounded Rust client and wifi-densepose spaces CLI using stored OAuth or hidden COGNITUM_SPACES_API;
• HTTPS/redirect/credential/schema/size/depth limits and redacted credential diagnostics;
• exact HomeCore Edge boundary enforcement with recursive rejection of raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and identity observations;
• ADR-325 covering spatial state, local P2 normalization, tenant-scoped RuVector memory, derived lineage, and policy-gated actions.

Closes #1630.

Related: cognitum-one/api#187, cognitum-one/console#200, ruvnet/autogenous#1.

Validation

• cargo test -p ruview-cognitum-spaces: 6/6 passed.
• cargo test -p wifi-densepose-cli --no-default-features auth::tests --lib: 4/4 passed.
• cargo check -p wifi-densepose-cli --no-default-features: passed; only the pre-existing Windows permission helper warning remains.
• Live gateway read using the externally supplied root .env credential: passed with the exact seven exclusion fields; the credential was never printed.
• Direct Cloud Run Function URL remained denied (403), preserving gateway-only invocation.
• Staged diff check and added-line secret scan: clean.