fix(auth): enforce scoped authorization for Kubernetes-backed resources

[supreme-gg-gg]

Several resource lists bypass collection scopes or authorize only a resource type. Restrictive authorizers therefore cannot consistently hide denied objects or authorize mutations against a specific resource.

This change:

• Reuses collection-scope matching across CRUD and custom list services.
• Filters prompt libraries, configured model providers, tool servers, tools, and WorkerPools before exposing their contents.
• Checks provider refresh permissions before discovery work and keeps WorkerPool permissions separate from other Substrate inventory.
• Restricts direct prompt operations to labeled library ConfigMaps and rejects ambiguous tool-server deletion.

Adds service, gRPC-client, and MCP regression coverage for scoped results and denial before side effects, including existing SandboxTemplate authorization paths. No protobuf changes.