#834 Upgrade auth lib to >=2.4.0 (auth 3.0.0 deprecation notice) + answer runflow RF-58 fix-notice

EARS SPEC: - The Highway platform shall pin the auth Python library to >=2.4.0 (the 3.0.0 migration vehicle). - When Highway performs RBAC operations via the embedded Authorization API, the platform shall behave identically under auth 2.4.0 as under 2.3.1 (verified by the RBAC/security test suites and a live permission check through the API). - If auth 2.4.0 introduces schema changes to auth_rbac tables, then Highway shall apply them via the existing migrations-entrypoint create_tables path before workers serve traffic. - When the upgrade is verified, Highway shall reply to auth thread thr-08d07c24b8454cee817b with a 'Migrated' confirmation stating that Highway uses only the embedded Authorization/auth.database API (no Client/EnhancedAuthClient HTTP transport, so the legacy transport-failure dict is unreachable). - When the RunFlow integration surface has been audited, Highway shall reply to runflow thread thr-073b5f381c6d40df9814 with a verify-result stating whether any of the 8 RF-58 behavior changes affect Highway. - If outbound agent-mail keeps failing with 429 quota_unconfigured, then Highway shall record the failure and retry rather than silently dropping the replies.