v0.46.0 — authorization (gates & policies)

Authorization on top of authentication — where auth() is who you are, this is what you're allowed to do. In the spirit of Laravel's Gate.

• Gates — define("update-post", (user, post) => post.authorId === user.id); check with can / cannot / authorize (throws a 403).
• Policies — policy(Post, PostPolicy) groups abilities as methods on a plain class; can("update", post) routes to PostPolicy.update(user, post) by the argument's class.
• canFor / authorizeFor check a specific user (jobs, tests, impersonation); gateBefore short-circuits every check (super-admin bypass).
• The current user resolves from auth().user() by default (setUserResolver to override for token auth); unknown abilities deny.

Composes directly with the session auth layer. 293 tests; type-checked doc examples (which caught and fixed a policy-class typing footgun). See docs/authorization.md.