Per-route capability authorization for the agent-layer REST surface. The auth middleware only authenticates; each handler asks this module whether the presented bearer covers the space and right it is about to touch.

Three principals fall out of the bearer: - a capability token (bsp_...) is verified against the space with barrel_caps:verify/3 (wrong space and insufficient rights are 403s, a token dead since the middleware check is a 401); - any other bearer is a global token the middleware already validated: full access; - no bearer means the middleware is not installed (open mode): full access, matching the rest of the API.