fix(authz): anchor tenant-scope auth exemption to exact paths

[rrrodzilla]

Summary

Closes an authorization-bypass class in the tenant_scope middleware introduced alongside #70 (GET /auth/me, merged in #72).

The middleware exempted identity endpoints from tenant scoping with an unanchored substring test:

if request.uri().path().contains("/forge/auth/") { return next.run(...).await; }

Any request path that merely contains /forge/auth/ would skip tenant scoping and reach tenant-scoped entity data unscoped. Vectors:

• Substring: /forge/Account/forge/auth/me
• Prefix + traversal: /forge/auth/me/../Account/123 (should an upstream proxy fail to normalize ..)

Flagged by automated security review (MEDIUM — Substring/Unanchored Allowlist Bypass).

Fix

• Replace the substring check with an exact-match allowlist of the three known identity routes (/forge/auth/{login,refresh,me} — the path shape this layer observes, since it wraps the /forge nest but sits under the /api/v{n} version mount).
• Extract the decision into a pure is_tenancy_exempt(path: &str) -> bool so the security-relevant logic is directly unit-testable.
• Future /forge/auth/* routes are not silently exempted — they must be added to the allowlist explicitly.

Tests

• Added unit tests for the exact-match path and for the substring/traversal/prefix/trailing-slash bypass vectors. The prior early-out had no regression coverage — the integration harness (auth_login.rs) mounts auth_routes() without this layer.
• Full crate suite green: 462 passed. cargo clippy -p schema-forge-acton --all-targets: 0 warnings.

Follow-up to #70 / #72.