Centralize resource authorization decisions

[wienans]

Summary

• add one resource authorization decision module for view, edit, delete, and named Access management
• bind Exercise, TacticBoard, and PracticePlan Access lookups behind resource adapters
• migrate individual-resource controller checks to consistent Owner, Admin, grant, and Public rules
• keep edit authority for visibility and Share Link changes while restricting deletion and Access management to Owner/Admin
• map unauthenticated and forbidden decisions consistently to 401 and 403

Tests

• npm run build
• authorization suites: 183 tests passed
• full server suite: 26/27 suites passed; the remaining MongoMemoryServer startup timeout passed all 6 tests when rerun alone

Scope

• collection visibility filtering remains unchanged and out of scope
• Share Link token resolution remains separate from User authorization