#839 Upgrade auth to 3.0.0 (strict-default flip with grandfathering; client always raises)

EARS SPEC: - The Highway platform shall pin auth>=3.0.0 and deploy it with the migrations entrypoint running create_tables BEFORE api/workers serve (grandfather pass writes strict_users=false for all existing creators, marker __meta:grandfathered-3.0__). - While #838 (key-backed users) is not landed, Highway shall set AUTH_STRICT_USERS_DEFAULT=false process-wide so tenants provisioned after the upgrade keep current behavior (auth-sanctioned embedded path). - When the upgrade is deployed, existing-tenant RBAC shall be verified unchanged through the product interface (member 200 / non-member 403) and the grandfather effect shall be verified (existing tenant reads strict_users=false). - When the upgrade is deployed, the settings default shall be verified in both directions (env-var false -> new namespace reads false; without the env var the library default is true). - When 3.0.0 is verified, Highway shall re-verify the 2.5.2 sslmode precedence fix with the original reproduction (explicit ?sslmode=disable honored, non-TLS connection to a remote host) and reply with output on thr-422d285aafb04e94812d, and shall reply to the 3.0.0 notice thr-bf4897f5479a485daa62. - If any auth_rbac table is added by 3.0.0, then the initialize_auth_schema effect-verification set shall be updated to include it.