feat(management): expose position reads to OAuth callers

[windischb]

Summary

• add a protected, realm-seeded modgud.management scope targeting urn:modgud:management-api
• add an explicit dual-auth management endpoint policy for first-party cookies, delegated Person tokens, and Service Account client_credentials tokens
• expose GET /api/position and GET /api/position/{id} through that policy with the existing live position:read permission
• keep all Position mutations and every other admin endpoint cookie-only
• document setup and wire contract for generic consumers

Security and upgrade behavior

• require both management scope and audience
• resolve the live Person/Service Account and its current Modgud permission on every request
• validate the persisted client, Service Account linkage, active state, current scope assignment, and strict grant separation
• reject dynamically registered clients
• reconcile a pre-existing custom modgud.management scope to the canonical safe shape during realm seeding
• preserve explicit opt-in: ordinary admin endpoints do not become bearer-callable

Scope

This closes the Position read/provisioning prerequisite that prompted the AlertHub request, but the implementation and documentation are product-generic. Event transport, provisioning sync semantics, and exposing additional management resources remain separate follow-up decisions/PRs.

Verification

• dotnet build src/dotnet/Modgud.slnx --no-restore
• full unit suite: 1,523 passed
• full API integration suite: 705 passed
• focused Management API contract suite: 8 passed, including JWT and reference access tokens
• cold-start scope/audience seed test passed
• VitePress production build passed

No stable Docker container or PostgreSQL instance was modified during implementation or verification.