[#1498] Enforce verifier authorization on every validation transition - #1595

Summary

• Centralize verifier queue authorization for verify, validate, and approve actions.
• Reject missing, unassigned, stale, and already-settled verifier work before mutation.
• Preserve the approved verifier pool semantics for M-of-N approvals while keeping direct validation assignment-safe.
• Emit ordered audit events for verification, approval recording, and milestone settlement.

Implementation details

• Added stable machine-readable authorization errors and a monotonic lifecycle transition guard.
• Applied the guard to the route and service paths so direct callers cannot bypass assignment checks.
• Preserved idempotency replay behavior and existing single-/multi-verifier contracts.
• Added focused regression tests for role boundaries, reassignment races, replayed decisions, invalid transitions, and event ordering.
• Documented the authorization decision table, failure behavior, and operational trade-offs.

Validation

• npm test -- --runInBand src/services/verifierTransitions.test.ts src/tests/milestoneLifecycle.test.ts src/routes/milestones.lifecycle.test.ts
• Result: 107 tests passed.

Closes #1498