feat(auth): refuse observers every endpoint that changes the organization - #2546

🟢 Confidence 8/10 · likely safe to merge. Fail-closed gate with readable markers; the internal and public middleware wiring has no end-to-end observer test, only the gate functions.
_{no findings · tests partial −1 · risk high −1}

Refuses a read-only role every non-GET endpoint the internal, public and /v2 auth middlewares serve, unless the endpoint (or its group) is marked ObserverAccess or /v2 already names the route a read. The markers match what those handlers change, and the default is refuse.

• refuseObserverWrites fails 403 ReadOnlyRoleError in the internal and public auth layers
• refuseObserverWritesV2 reuses the /v2 scope registry's read-only POST list
• ObserverAccess marks the six query groups plus the caller's own devices and approvals
• Endpoint-level read marks cover digest, billing, integrations and the escalation dry run

Before merge

• Manual · Verify every Clerk role key in dev and prd is known to roleOf; an unknown key reads as observer

Production impact

_{11938f4 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}