fix(router): bound websocket authorization variables

[first-assist]

Summary

• replace full WebSocket variable duplication with a bounded scalar authorization projection
• preserve fail-closed variable-dependent authorization before subgraph execution
• keep large subscription payloads below the private 64 KiB frame limit

Verification

• cargo fmt --all --check
• bounded cargo test -p graphql-orm-router --features auth-agql (72 unit/wire tests + binary smoke)
• bounded cargo clippy -p graphql-orm-router --all-targets --features auth-agql -- -D warnings
• bounded cargo doc -p graphql-orm-router --features auth-agql --no-deps
• python3 scripts/generate-workspace-inventory.py --check
• git diff --check

Documentation impact

• Documentation updated
• No documentation impact

python3 scripts/check-documentation.py is independently blocked by four already-expired review_by: 2026-09-01 dates outside this change.