fix: enforce scoped Agent Run access

[Super-Sky]

Scope

• Protect all six app-facing Agent Run routes with a dedicated app token and exact workspace/app-instance scope.
• Make authenticated scope authoritative for create and inherited by resume.
• Authorize TaskRun ownership before reading child trace records; return identical generic 404 responses for missing and cross-tenant runs.
• Recursively redact credential-like DTO fields and remove app-facing projection semantic payloads.
• Add OpenAPI security metadata, deployment config, bilingual feature docs, real-scenario checks, and a 100-scope benchmark.

Explicit boundaries

• Existing authenticated Control Plane sessions remain system-admin reads; workspace-operator RBAC is not simulated in this change.
• APP_AUTH_REQUIRED=false remains an explicit local/gray mode; the production env example enables it.
• Legacy runs without provable ownership fail closed for app APIs.

Verification

• go test ./... (pass)
• go vet ./internal/server (pass)
• python3 scripts/check_no_absolute_paths.py (pass)
• docker compose config using deploy/athena.env.example (pass)
• 100-scope auth benchmark: 1.5-1.7 us/op, 48 B/op, 3 allocs/op
• Independent Codex review found generic token/cookie key gaps; fixed with regression coverage.

Stack

• Base PR: feat: add agent trace timeline readout #19
• This PR is intentionally based on codex/agent-trace-timeline-issue-11 because the authorization boundary protects the Agent Run trace/manifest API delivered there.

Refs #26