feat(grove): add actor authentication and orb dev controls

[lishaduck]

Summary

• add Grove's durable Actor authority for People and Agents, including issuer-qualified external identities, Home Host ownership, lifecycle/currentness, explicit Agent enrollment, and capability/access containment
• converge browser Remote Functions, REST, and MCP on shared server-stamped invocation context and transport-blind named Sprout commands
• adopt the official MCP v2 server/client flow with protected-resource OAuth ingress, audience/scope validation, current per-operation authorization, and bearer-only MCP identity
• harden browser OIDC/Better Auth composition, owner bootstrap/readiness, token storage, and Person session hydration
• add an orb-native development control plane: supervised Grove/OIDC services, idempotent ensure command, __dev login/logout/preflight, bounded sanitized browser logs, persistent dev signing keys, and explicit MCP Agent enrollment
• document the Actor authority model and exact agent-facing orb workflow

Security boundaries

• browser sessions and MCP bearer credentials remain separate trust domains; cookies never authorize /mcp
• unknown, non-current, and unbound Agent identities fail closed; enrollment is explicit
• grove:mcp is transport admission, not blanket command capability
• __dev requires both a SvelteKit development build and GROVE_ORB_DEV_AUTH=1; production build verification excludes its implementation
• the checked-in MCP development credential is intentionally limited to trusted disposable-orb owners and is explicitly documented as unsafe for production

Validation

• vp run --filter @petalnet/grove test — 79/79 passed
• vp run --filter @petalnet/grove check — 0 errors, 0 warnings
• vp run --filter @petalnet/grove build — passed, including production control-plane exclusion
• vp run --filter @petalnet/effect-api test — 14/14 passed
• scoped ESLint, Oxlint, Knip, formatting, shell syntax, and git diff --check passed during the audited implementation run
• public orb login/logout/preflight and official MCP v2 Agent enrollment passed
• OIDC-only restart preserved Grove's PID and signing key ID; a fresh Agent enrollment succeeded immediately afterward

Operational entrypoint

Run .agents/ensure-grove from the repository root. Grove-specific orb guidance lives in apps/grove/AGENTS.md.