RBAC read-deny: server-minted get-by-key tier (Authorization, Document) — setup→test key handoff

Follow-up to #373 (which broadened read-side RBAC deny-tests to the client-minted get-by-key tier). This adds the server-minted-key get-by-key resources: Authorization (GET /authorizations/{authorizationKey}) and Document (GET /documents/{documentId}).

These are simple to create (one admin POST), but the key is minted by the server, so unlike the client-minted tier we can't hardcode it in the SLICE. Needs a setup→test key handoff:

• global-setup creates the resource as admin, captures the minted key from the response,
• and makes it available to the generated deny-test at runtime (e.g. a setup-written support/rbac-keys.json the spec reads, or an env var), since the key isn't known at generation time.

The deny-test then fetches that runtime key as the zero-grant probe → expect 403/404 (same assertResponseStatusOneOf path as #373).

Authorization is the marquee RBAC resource, so this is high value. Build the key-handoff mechanism once here; it's reusable for any future server-minted target.

Relates to #359, #373.

Start with the implementation of #373, then inspect global-setup and the generated deny-test path using SLICE. Define the setup-to-test handoff, such as support/rbac-keys.json or an environment variable, for the server-minted Authorization and Document keys. Done means admin setup creates both resources and the zero-grant probes read the runtime keys and pass through assertResponseStatusOneOf with 403/404.