#929 Authorization via hosted auth service; hw_k1_ keys kept; Google login removed

EARS SPEC: - require_permission shall decide via hosted auth (one namespace per Highway tenant) with a per-request fetch and a TTL cache whose revocation bound is stated in seconds. - The auth_rbac schema and sqlalchemy dependency shall be removed after data migration. - hw_k1_ API keys shall continue to authenticate highway-mcp and dashboard callers. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.