feat(shared): add Principal, InstanceRole, AppRole, Scope, ApiKeyId

Cross-crate authn/authz data types for Phase 3.5. The Principal struct
is the resolved caller identity that auth_middleware will produce for
both cookie sessions and bearer API keys; the role/scope enums mirror
the DB CHECK constraints from migration 0006 and round-trip through
their stable string forms.

UserId is a type alias for AdminUserId — the auth layer treats an
admin row as the principal identity, so the alias avoids a rename of
the existing id type.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/ids.rs

@@ -52,3 +52,4 @@ id_type!(ExecutionId);
 id_type!(RequestId);
 id_type!(AdminUserId);
 id_type!(AppId);
+id_type!(ApiKeyId);