#1052 Adopt auth 3.5.0 check_schema in place of Highway's own column check

EARS SPEC: - The highway lock shall install auth==3.5.0 (wheel sha256 3e0a7ba8e7ebdce1d8095691fe88debf1eda1faaa5ee2570ac0f751ba08a54dd). - When initialize_auth_schema runs, it shall call auth.check_schema(engine) once, after create_tables(raise_on_error=True) and after the fixed required-table check. - If check_schema raises SchemaMismatchError, then initialize_auth_schema shall re-raise it and the migrations container shall exit non-zero. - If any of the seven required auth_rbac tables is absent, then initialize_auth_schema shall raise naming them, even when the installed auth models declare no tables (check_schema alone passes that case vacuously). - check_schema shall not run on a request path (one catalog read per process start; auth measured 467 ms over TLS). TECHNICAL PROBLEMS: 1. Schema drift detection between an embedded ORM's models and the live catalog. SOLUTION DOMAINS: - auth library's own check_schema (house tool, auth #37, 3.5.0). Diff 3.4.0 -> 3.5.0: new auth/schema_check.py, create_tables calls check_schema, two exports; nothing else. ALTERNATIVES: - auth.check_schema [CHOSEN]: maintained with the models by their owner, covers missing tables too. - keep missing_model_columns [REJECTED]: duplicates the library, drifts when auth changes schemas. - defer to after the first CI deploy [REJECTED]: batch is unpushed; one auth bump instead of two. Follows #1045.