Add ConnectRPC interceptor for cross-service permission checks

[haasonsaas]

Context

As Tier 2 services build out, every service needs to verify caller permissions via identity's CheckPermission RPC. Rather than each service implementing this independently, service-runtime should provide a shared ConnectRPC interceptor.

Requirements

• Implement PermissionInterceptor that extracts caller identity from request metadata
• Call identity's CheckPermission RPC with the caller, resource, and action
• Support declarative permission annotations on service methods (e.g., require: "meter:budget:write")
• Cache permission results in Redis with short TTL (30s) to avoid per-request round-trips
• Return proper ConnectRPC error codes on denial (permission_denied with descriptive message)
• Bypass for internal service-to-service calls using mTLS identity
• Add unit tests with mock identity client

Why in service-runtime

This is cross-cutting infrastructure. Implementing it once in the shared runtime means all 20+ services get consistent permission enforcement with a one-line interceptor registration.

Dependencies

• evalops/identity — CheckPermission RPC must exist first
• evalops/proto — permission annotation proto options

[haasonsaas]

Current Progress: ~10%

Reusable foundation exists

• authmw/authmw.go — HTTP bearer token + API key authentication middleware (authn, not authz)
• rterrors/connect.go — Maps errors to ConnectRPC codes including CodePermissionDenied
• identityclient/client.go — Identity client, used by authmw
• ConnectRPC interceptor framework vendored and ready

Completely absent

• PermissionInterceptor (no ConnectRPC interceptor in non-vendor code)
• CheckPermission RPC call, Redis cache, permission annotations, mTLS bypass, tests

Hard blocker

Depends on identity.CheckPermission RPC — neither in proto (evalops/proto#71) nor implementation (evalops/identity#104). Must start with proto definition.

Suggested approach

Build as a ConnectRPC UnaryInterceptorFunc that reads method-level permission annotations, extracts caller identity from context (already provided by authmw), calls identity.CheckPermission with Redis cache, returns CodePermissionDenied on failure.