feat(auth-rbac): implement isomorphic RBAC security engine with FLS, M2M agent guards and tarpitting

[crapougnax]

Closes #24

Summary of Changes

1. New Package @quatrain/auth-rbac:

   • Macro-Security: Route and endpoint matching with glob pattern support (/**, /public/*) and semantic business actions (READ, WRITE, UPDATE, DELETE, MANAGE, *).
   • Micro-Security (FLS - Field-Level Security): Calculation of field access modes (hidden, readonly, readwrite) per entity property with full role inheritance.
   • Automated Payload Sanitization: sanitizeRead() and sanitizeWrite() methods eliminating schema duplication and preventing unauthorized property mutations.
   • M2M & AI Agents Defense with Tarpitting: Distinction of subject types (human, agent, service) with built-in TarpitManager (dynamic latency injection and request throttling against scraping bots and runaway agent loops).
   • Isomorphic Middlewares: AbstractRbacMiddleware base class with concrete adapters for Express (ExpressRbacMiddleware) and Astro SSR/API (AstroRbacMiddleware).

2. Quality & Quality Gates:

   • 100% co-located unit test coverage (4 suites, 22 tests passing).
   • 100% compliant with scripts/audit-jsdoc.ts quality gate.
   • Pristine registry bundle with test file exclusions in .npmignore and package.json.
   • Pre-release beta configuration: "version": "1.0.0-beta.1" with publishConfig: { "tag": "beta" }.

[github-actions]

🚀 On-Demand QA Preview Packages (PR #25)

Preview packages have been published to NPM and GitHub Packages with dist-tag pr25.

Installation in client applications / QA testing:

yarn add <package-name>@pr25
# or
npm install <package-name>@pr25

[sonarqubecloud]

Quality Gate passed

Issues
16 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud