Add pluggable auth chain, session extensions, and lifecycle observabi…

[ajit-zer07]

Summary

• Pluggable auth resolver chain (src/auth/) with StaticBearerResolver
  and JwtBearerResolver (JWKS inline or URL with TTL cache; RS256 /
  ES256 / HS256). Bearer scheme only: removes MACP_ALLOW_DEV_SENDER_HEADER
  and the x-macp-agent-id header; dev mode now accepts any bearer
  token as the sender identity for tests.
• Session extension framework (src/extensions/): SessionExtensionProvider
  trait with on_session_start / on_session_terminal callbacks, invoked
  per-session based on declared extension keys. Provider errors are
  logged and non-fatal (invariant E-1).
• Session lifecycle observability: new ListSessions and WatchSessions
  RPCs, a lifecycle broadcast bus, and Created / Resolved / Expired
  events emitted from runtime transitions (session start, resolve, TTL
  expiry, cancellation, background cleanup). SessionsCapability now
  advertises list_sessions + watch_sessions.
• Identity gains an is_observer flag — observers can read any session
  via GetSession without being in participants.
• Aligns with macp-proto changes: SessionStartPayload.context: bytes
  is replaced by context_id: string + extensions: map<string,bytes>;
  policy rules carried as a JSON string instead of bytes. Session /
  persistence / replay / all mode tests updated accordingly.
• New env vars: MACP_AUTH_ISSUER, MACP_AUTH_AUDIENCE,
  MACP_AUTH_JWKS_JSON, MACP_AUTH_JWKS_URL, MACP_AUTH_JWKS_TTL_SECS.
• Dependencies: adds jsonwebtoken = "9" and reqwest = "0.12".

Notes for reviewers

• Cargo.toml temporarily points macp-proto at the local
  ../multiagentcoordinationprotocol/packages/proto-rust path to
  unblock development of the WatchSessions / extensions proto
  changes. Must be switched back to a crates.io version (target:
  macp-proto = "0.2.0") before this PR merges.
• SecurityLayer::authenticate_metadata currently bridges sync-to-async
  via block_in_place + Handle::current().block_on because the gRPC
  request auth path is sync. Worth reviewing whether that path should
  become async instead.

Test plan

• cargo build and cargo clippy
• cargo test (all unit + Rust integration tests)
• cd integration_tests && MACP_TEST_BINARY=../target/debug/macp-runtime cargo test -- --test-threads=1 (Tier 1 gRPC + Tier 2 agents)
• Manual: start runtime with MACP_AUTH_ISSUER + MACP_AUTH_JWKS_URL, issue JWT, verify sub becomes sender
• Manual: WatchSessions receives initial CREATED burst then incremental CREATED/RESOLVED/EXPIRED events
• Manual: observer identity (is_observer: true) can GetSession for a session it did not participate in