fix(auth): authorize legacy bank writes before provisioning

[r266-tech]

Summary

• authorize the deprecated profile response read before any disposition mutation
• route legacy disposition and mission writes through the unified create-bank lifecycle
• validate read, write, and create hooks exactly once before writes or mission-merge LLM work
• keep lazy creation and legacy writes atomic on one connection, then apply defaults once after commit
• return disposition responses from a transaction-locked snapshot and reject stale mission merges with an internal_id + updated_at compare-and-set

Fixes #3036.

Tests

• 22 focused authorization, provisioning, compatibility, rollback, and concurrency regressions
• 8 existing agent-profile, mission, and full API workflow tests
• targeted Ruff check and format check
• git diff --check

Review note

Adversarial review was reworked across several rounds: the final patch adds compatibility-safe preauthorization, row locking, zero-row detection, a locked response snapshot, post-commit config fallback, and portable stale-write protection for PostgreSQL and Oracle.

The remaining review concern is the repository's existing connection-bound provisioning contract: HINDSIGHT_API_DEFAULT_BANK_TEMPLATE is best-effort, opens separate connections, and therefore runs after the caller transaction commits using bank_id. Fully lifecycle-binding every template resource write would require a broader provisioning-state design; this PR preserves the explicit contract described in _ensure_bank_exists() and issue #3036 rather than expanding that architecture.