@callback authorize(actor :: term(), action :: atom(), subject :: term()) ::
  :ok | {:error, :unauthorized | term()}

Authorizes a delivery action for an actor against a subject.

Implementations should return :ok to permit the action or {:error, :unauthorized} (or another tagged error term) to deny it. Authorization runs before any URL is issued and before any storage I/O is attempted, so denials prevent presigning and reading entirely.