[Hosted agents 10] Prove document-level authorization through the hosted path

## Summary
Prove end-to-end document-level authorization for hosted orchestration with two users from different Entra groups.

## Why will we implement this?
- **Problem / opportunity:** The hosted gateway changes identity propagation and can accidentally bypass classic OBO trimming.
- **Business value / outcome:** Hosted mode preserves GPT-RAG's non-negotiable security boundary.
- **Success metrics (how we know it worked):** The authorized user retrieves a protected document and the unauthorized user cannot retrieve or infer it through chat, citations, tools, or logs.

## What does it do? (Functional Overview)
- **Core behavior:** Validate the task-01 identity contract through UI, hosted agent, Toolbox, Foundry IQ/Search, and document permissions; include negative tests.
- **Data collection / storage needs:** Use synthetic test identities/documents and never record bearer tokens.
- **Data analysis / reporting needs:** Capture authorization decisions and correlation evidence without protected content.
- **Nice to have (stretch goals):** Automated regression fixture for both classic and hosted paths.

## Components
- **Components (check all that apply):**
- [x] gpt-rag-orchestrator
- [x] gpt-rag-ingestion
- [x] gpt-rag-ui
- [ ] gpt-rag-mcp

## Dependencies and acceptance criteria
- **Depends on:** none. #592 was closed on 2026-09-03, and both technical blockers recorded in this issue have since been resolved.
- Both positive and negative users are exercised.
- No token appears in hosted-agent or tool logs.
- Failure blocks hosted-mode promotion; there is no silent security fallback.

## Blocker status at the currently published pins
The two blockers recorded in the 2026-08-11 comment no longer hold at
`gpt-rag-ui v2.6.2` / `gpt-rag-orchestrator v4.1.1` (umbrella `v3.8.3`):

- [x] **Foundry `storage_error` on every hosted turn.** Resolved. `gpt-rag-orchestrator#313` merged on 2026-08-11 and sends `store: false` on the Responses API call; the fix is contained in `v4.1.1`.
- [x] **The UI called the hosted agent with its own managed identity rather than a per-user delegated token.** Resolved. `hosted_agent_client.py` at `v2.6.2` defaults `HOSTED_AGENT_AUTH_MODE` to `user_delegated` and performs an OAuth2 On-Behalf-Of exchange of the signed-in user's token, with `service_identity` available only as an explicit opt-out.

The remaining blocker is operational rather than a product defect: minting the two
temporary Entra test users this gate requires needs a directory role such as User
Administrator, which the validating identity does not hold, and no interactive
browser sign-in is available to complete an alternative flow. See the 2026-08-12
comment. Resolving that access is the only prerequisite left before the two-user,
two-group live proof can be attempted.

Start with the task-01 identity contract and hosted_agent_client.py at gpt-rag-ui v2.6.2, then review the published orchestrator and umbrella pins. Arrange two temporary Entra users in different groups and exercise the UI, hosted agent, Toolbox, Foundry IQ/Search, citations, tools, and logs. Done means the authorized user retrieves the document, the unauthorized user cannot access or infer it, and no bearer token or protected content is logged.

Written by the indexing model from the issue text.