[codex] add scoped Auth subject status reader

[SadPossum]

What changed

• Added the Contracts-only IAuthSubjectStatusReader and minimal AuthSubjectStatusSnapshot.
• Added an explicit, idempotent, replacement-friendly AddAuthSubjectStatusReader() composition opt-in.
• Added a no-tracking persistence reader that returns only persisted scope, canonical Auth subject, and MemberStatus.
• Added trust, privacy, scope, recovery, and consumer obligations to the Auth documentation.

Why

Trusted product orchestrators need to prove that an intended durable owner is a real, currently active Auth account without reading AuthDbContext directly, using verified email as a proxy, or exposing a public account-discovery endpoint.

Safety and compatibility

• Scope is not caller input. Lookup is bound to the composed fixed or ambient IAuthScopeContext.
• Disabled, missing, invalid, or DbContext-mismatched scope state fails closed.
• The normal EF scope filter remains active and an explicit ordinal row-scope predicate is also applied.
• Parseable GUID variants resolve to the canonical lower-case D subject used by Auth tokens and ordinal downstream identity.
• Invalid, zero, and missing subjects return no match; disabled and unknown statuses remain truthful fail-closed results.
• Ordinary Auth composition does not register this capability.
• No HTTP/Admin/CLI route, PII, ownership policy, event, Framework change, schema change, or migration is added.
• The change is additive for existing BunkFy consumers.

Verification

• Solution build: 0 warnings, 0 errors
• Non-Docker unit/contract suite: 320/320
• PostgreSQL and SQL Server Docker integration suite: 3/3
• Auth boundaries and solution synchronization: pass
• SQL Server and PostgreSQL migration drift: no pending changes
• Repository security and release policies: pass
• Vulnerable package audit: none across 17 projects
• Independent red-team review: no unresolved P0/P1/P2 findings

Consumer obligation

This is point-in-time Auth status evidence, not product authorization or a lease. Consumers must authorize the ownership action, persist/use the returned canonical subject, and re-check status at the appropriate provisioning and activation boundaries.

This is a prerequisite for the StayQuest Hostels organization-binding slice, alongside GMA Organizations PR #11 and later source-train convergence.