[EPIC] feat(mcp-server): enterprise governance — identity propagation, authorization-scoped discovery, write denial, and audit

### Describe the proposal

The MCP server currently operates as an anonymous, single-identity reader with no authentication, no authorization enforcement, and no audit trail. This epic tracks the work to make it safe for multi-user, governed deployments where:

- AI agents discover metadata within the scope of their granted permissions only
- Unauthorized write operations are explicitly denied by the authorization layer (not merely hidden)
- Every access produces an attributable audit record

**Background:** The Gravitino core REST endpoints already apply `FILTER_*_AUTHORIZATION_EXPRESSION` on list results. Once identity flows from the MCP layer, authorization-scoped discovery is inherited automatically — no filtering logic is added in MCP itself.

### Task list

- [ ] #11565 — Setting + CLI: add `--token` auth parameter ✅
- [ ] #11566 — Identity propagation: inject Bearer token into every Gravitino REST call ✅
- [ ] #11567 — Enable tag write tools protected by Gravitino authz ✅
- [ ] #11568 — Audit logging: structured per-tool-call audit records attributed to principal ✅
- [ ] #11571 — Unit tests: auth flow and audit behaviour ✅
- [ ] #11572 — HTTP transport: per-request token isolation for concurrent multi-principal sessions ✅
- [ ] #11574 — Write operations for catalog, schema, table, model, topic, fileset
- [ ] #11575 — Integration tests: per-user authorization validation with live Gravitino

Start by reading the task issues #11565, #11566, #11567, #11568, #11571, #11572, #11574, and #11575, then trace the Gravitino core REST endpoints and their FILTER_*_AUTHORIZATION_EXPRESSION behavior. Done means the listed identity, authorization, write-denial, audit, transport-isolation, and integration-test tasks are completed for governed multi-user deployments.

Written by the indexing model from the issue text.