feat(auth): PlatformAuth trusts identity from trusted forwarder + local-dev bypass

[I-am-nothing]

Summary

Second slice of the tunnel-auth workstream (see `memory/feedback_tunnel_auth_no_bypass.md`). Closes the SDK side of the gap that today makes `/platform/*` routes unreachable from `mirrorstack dev` UIs:

`auth.PlatformAuth` only honors `Identity` already preset in ctx. The Lambda runtime sets it in prod. In local dev nothing does, so every Platform-scope request 401s.

This PR teaches PlatformAuth two new identity sources. No second secret is introduced — the same `MS_INTERNAL_SECRET` that PR mirrorstack-cli#33 injects now also gates trusted-forwarder identity injection.

New behavior matrix

```
inLambda + secret unset → 503 (operator misconfig — matches InternalAuth)
inLambda + secret set → enforce: validate secret + identity headers
(Lambda authorizer path still wins if Identity
is preset in ctx)
local + secret unset → BYPASS: inject synthetic admin Identity so
'mirrorstack dev' (no tunnel) can render
platform-scope routes without ceremony
local + secret set → enforce ('mirrorstack dev --tunnel' — CLI sets
the secret via mirrorstack-cli#33)
```

Identity sources, first match wins:

1. Preset in ctx (Lambda authorizer)
2. Trusted-forwarder: `X-MS-Internal-Secret` valid + `X-MS-User-ID` / `X-MS-App-ID` / `X-MS-App-Role` headers present → Identity injected
3. Local bypass: synthetic `local-dev-user` / `local-dev-app` / `admin`

Cascade unblocked

Slice	Repo	Status
1. CLI generates secret, injects `MS_INTERNAL_SECRET`	mirrorstack-cli	#33 ✅ open
2. SDK trusts identity headers from secret-bearing caller	app-module-sdk	this PR
3. Dispatch parses `internal_secret` + signs forwarded requests	api-platform	follow-up
4. Platform-side proxy at `/apps/[id]/[slug]/api/[...]`	web-applications	follow-up
5. Bundle reads `apiBase` from mount context	bundles	trivial follow-up

With (1)+(2)+(4) landed, plain `mirrorstack dev` (no tunnel) renders modules' `/platform/*` routes end-to-end against a synthetic admin identity. (3) is the production-shape path that handles real users via dispatch.

Test plan

• `go test ./auth/...` — 7 new PlatformAuth tests all pass (ctx-preset, local bypass, lambda 503, missing secret, wrong secret, missing identity headers, valid headers → identity injected)
• `go test ./internal/core/...` — new `TestPlatform_LocalDevBypass_InjectsSyntheticAdmin` and `TestPlatform_SecretSet_RejectsNoHeader` replace `TestPlatform_RejectsNoAuth`, pinning the new contract through the SDK's scope-routes plumbing
• Whole-repo `go test ./...` clean except for a pre-existing flake in `internal/refcache.TestSlowPath_SingleflightCoalesces` (passes on retry; concurrency-timing test, unrelated)

Notes

• No changes to InternalAuth — its existing matrix is unchanged.
• The trusted-forwarder headers (`HeaderUserID`, `HeaderAppID`, `HeaderAppRole`) are exported so dispatch + the platform proxy can reference the same constants when forwarding.
• `Set` already existed; we just call it from PlatformAuth now.

🤖 Generated with Claude Code