fix(auth): enforce tenant isolation and authorization boundaries across auth flows

[harryjupiter148]

Summary

Enforces strict authorization boundaries and tenant isolation across sign-in, refresh, verification, logout, and recovery flows in meridian-api/src/auth:

• Tenant Isolation in TokenStore: Tracks token-to-subject ownership (token_subjects) and enforces tenant boundaries on token revocation and verification. Revoking tokens for Tenant A no longer revokes tokens belonging to other tenants.
• Token Verification & Tamper Detection: Verifies that presented access tokens match both the active store and their issued subject (verify_access_for_subject). Forged subjects are rejected before advancing state.
• Tab & Device Isolation: Introduces paired_access tracking so rotating a refresh token in one browser tab invalidates only that tab's access token while preserving concurrent sessions on other tabs/devices.
• Atomic Logout & Subject Boundary: Resolves borrow-checker conflicts during session supersession/revocation and adds logout_for_subject to verify session ownership before modifying state.
• Hardened Account Recovery: Binds recovery tokens to the session subject in request_recovery and complete_recovery, preventing cross-tenant recovery hijacking, token tampering, and unauthorized request cancellation.
• Zero Partial State on Failure: Guarantees that stale, expired, replayed, or cross-tenant operations exit immediately with explicit AuthError variants and zero side effects.

Type

• Bug fix
• New feature
• Documentation
• Refactor
• Smart contract change

Related Issue

Closes #1643

Testing

• Tested locally on Testnet
• No TypeScript / Rust errors
• Docs updated if needed

Test Suite Execution

• cargo test: 142 passed, 0 failed, 0 warnings (all 128 existing tests + 14 new regression tests covering allowed, denied, forged-identity, and cross-tenant scenarios).
• cargo clippy: Passed with 0 warnings.

Screenshots (if UI change)

N/A — Backend / API authorization boundary security fix.