Add AuthProtocol enum (VerifyPubkey, VerifyToken, ReloadKeys, CheckAccess), AuthResult enum (Ok(Identity), Denied(String)), and AuthServiceImpl wrapping ConfigIdentityProvider via ArcSwap<DynamicConfig>. All gated behind the irpc feature flag per ADR-028.