Engine: scoped write roles (fact-writer, decider) and per-relation grants (EN-6) #259

Goal. Scoped write roles: a fact-writer role, a decider role (claims and decision records only), and per-relation grants.

Why. An API key that may write facts must not be able to change policy (rules, drops); the component that records decisions must not write facts. Today write access is all-or-nothing per key.

Done when. Roles and per-relation grants are enforced at commit for facts, rules and drops; refusals name the missing grant; .apikey can create keys with a role; documented with a security note.

Plan reference: EN-6. Security, needed before any hosted use. Part of the Engine production readiness milestone (the current focus; tracker #199). Rule for every engine PR: millisecond query and update latency must not regress, and the perf gate runs before the PR opens.