Design an auth/identity layer for AMS

[JSONbored]

Problem: Auth and identity are completely absent from every ledger and CLI path in AMS today, and none of it reuses the main product's existing GitHub-App-based auth — a hosted, multi-tenant service needs a real identity layer before it can safely serve more than one customer.

Area: AMS / Cloud architecture

Proposal: Design an identity layer for AMS's hosted mode, reusing the main product's existing auth patterns where they fit rather than building a parallel system.

Deliverables:

• A written auth/identity design, then an initial implementation.

Resources:

• The third-party autonomy & security governance spec already tracked in this milestone.

[linear-code]

JSO-3600