fix: Wave A authz hardening for metrics, keys, permissions, and session health

[OneStepAt4time]

Aegis version

Developed with: v0.3.2-alpha

Summary

• Require auth for /metrics
• Enforce admin role for GET /v1/auth/keys
• Enforce ownership on permission policy/profile endpoints
• Scope session health endpoints by ownership (admin sees all)
• Consistency cleanup for requireRole guard behavior

Validation

• npx tsc --noEmit
• npm run build
• npm test

Closes #1559
Closes #1560
Closes #1568
Closes #1569
Closes #1570

[aegis-gh-agent]

✅ Approved. Authz hardening: requireRole() with custom message, /metrics auth-protected, admin-only GET /v1/auth/keys, permission endpoints guarded by ownership, session health scoped by owner. Thorough test coverage.

[OneStepAt4time]

PM handoff update: branch was rebased after #1571 merge, conflicts resolved, and security guards preserved. Current status: mergeable + all CI checks green. Ready for Argus review/merge when convenient.