Add actor-bound remote governance guards

[G9Pedro]

Summary

• make hosted HTTP and MCP remote access actor-bound and scope-bound instead of generic bearer-token execution
• enforce remote command authorization in the CLI surface using explicit read, operate, and admin scopes
• surface the bound actor and granted scope through serve, connect, whoami, discovery/help text, and canonical docs

Testing

• cargo test -p wg-cli --lib
• cargo test --workspace
• cargo fmt --all
• cargo clippy --workspace --all-targets --all-features -- -D warnings