#1045 Pin auth 3.4.0; size and scope the embedded auth pool for pg-nano (AUTH_DATABASE_POOL_*), every Authorization session closed

EARS SPEC: - Highway shall pin auth==3.4.0 in pyproject.toml and uv.lock. - Every engine container that imports auth.database shall set AUTH_DATABASE_POOL_SIZE, AUTH_DATABASE_MAX_OVERFLOW, AUTH_DATABASE_POOL_TIMEOUT (and leave POOL_RECYCLE unset or valid); values in SPECS/925-cutover.patch shall keep total highway_app connections <= 60 (infra ruling). - Every Authorization instance Highway creates (enterprise/security/auth_wrapper.py get_auth_for_tenant / auth_for_tenant, enterprise/security/rbac_manager.py) shall have its session closed or rolled back before the request or task ends; no auth connection shall stay idle in transaction after a permission check (auth 3.4.0: reads leave the transaction open until the session closes). - The pool size per process shall equal the measured maximum number of concurrent permission checks in that process (hypercorn threads / to_thread), stated with the measurement. - If auth 3.3.0+ requires the auth_tenant_settings.rotate_key_hash migration, then the migrations container shall apply it before the api starts. - When the stack runs on pg-nano-03, the measured auth connections per api process (pg_stat_activity application_name auth_server, forensic read-only) shall be <= pool_size + max_overflow. CONTEXT: auth team answer 2026-10-22 (thread 01M5JVCJ9MS5E18JQZTC1VT4EP, msg 01M5JWAVWRHS1KMG36JAJYXWD2): settings AUTH_DATABASE_POOL_SIZE (>=1), MAX_OVERFLOW (>=0), POOL_TIMEOUT (s, >0), POOL_RECYCLE (-1 or >=1); empty string fails validation; defaults 2/2/10/3600. Two-connection path exists only under auth's own Flask app. Authorization reads hold a checked-out connection idle in transaction until close(); 3.4.0 adds close() and context-manager use; a caller-supplied db_session is left alone by close(). TLS URL params pass through to libpq unchanged (verified by auth with verify-full + client cert). Parent #925, #929.