export_local/export_to_s3 via `operations` allowlist bypasses table-level grants (non-SQL nested search)

### Summary

A role granted `export_local` / `export_to_s3` through its `operations` allowlist can export tables it holds no table-level grant on, when the export uses a **non-SQL** nested search (`search_by_conditions` / `search_by_value` / `search_by_hash`).

### Detail

`export_local` and `export_to_s3` are `requires_su` operations. In `verifyPerms` gate 2 (`utility/operation_authorization.ts:648-650`), an SU-only operation that is explicitly listed in a role's `operations` is treated as a deliberate grant and returns `null` (allow) **before any table-level check**. The additive AST permission check in `chooseOperation` (`server/serverHelpers/serverUtilities.ts:294`) only runs when the nested search `operation === 'sql'`, so a non-SQL nested search reaches the export handler with no table authorization at all.

Result: `export_local` in `operations` ⇒ read/export any table via a non-SQL nested search.

### Scope

- Pre-existing behavior; not introduced by the `chooseOperation` authorization fix. That change deliberately leaves this open because closing it changes authorization outcomes for existing role configurations, so it needs its own change + release note.
- Current behavior is documented in `DESIGN.md` (the `chooseOperation` section) and pinned by the `NESTED-NOSQL` case in `integrationTests/security/choose-operation-authz.test.ts`, so the fix has a test to flip.

### Fix direction

Fall through to a table-level CRUD check for `requires_su` ops granted via `operations` (rather than returning `null` unconditionally at gate 2), or run the export's table check for non-SQL nested searches too. Coordinate with the gate-2 TODO already noted at `utility/operation_authorization.ts:642-647`.

Start with utility/operation_authorization.ts around the gate-2 TODO at lines 642-650, then trace the non-SQL path through server/serverHelpers/serverUtilities.ts and the export handlers. Run integrationTests/security/choose-operation-authz.test.ts, especially the NESTED-NOSQL case; done means the unauthorized table export is rejected and the related DESIGN.md and release note are updated.

Written by the indexing model from the issue text.