Add authorization and abuse integration tests

Acceptance

Observable completion

• CI proves cross-account denial, token-state denial, rate limiting, service-role isolation, and protected asset denial.