@IfBuildProfile-gated beans never activate under calm-hub's documented runtime-profile deployment model

`@IfBuildProfile`/`@UnlessBuildProfile` bean selection is fixed at Maven build time and baked into the artifact — Quarkus's own CDI reference states runtime profile has no effect on `@IfBuildProfile` bean resolution. `calm-hub`'s CI builds one artifact with no `-Dquarkus.profile` flag (`mvn -P integration clean package`, `.github/workflows/docker-publish-calm-hub.yml`), and `calm-hub/deploy/docker-compose.yml` documents selecting the auth profile at container *runtime* instead — "For a production deployment select an appropriate auth profile (secure, proxy-auth)" via `-Dquarkus.profile=...` in `JAVA_OPTS`.

Under that documented deployment path, a bean gated `@IfBuildProfile(anyOf = {"secure", "proxy-auth"})` — or any other specific profile list — never activates for any runtime-selected profile, because the artifact was built under the default profile regardless of which profile is chosen at launch.

`org.finos.calm.security.UserAccessValidator` was exactly this case until #3065 (fixed there by removing the annotation): its absence under the documented deployment model silently made `SearchResource`, `DomainResource`, `NamespaceResource`, and the MCP `SearchTools.searchHub` fall through to "no filtering, see everything" for every namespace/domain, regardless of the caller's actual grants — in every profile that relied on it, not only the `oidc` profile added in that PR.

## Fix

- Audit every `@IfBuildProfile`/`@UnlessBuildProfile` usage in `calm-hub` (`grep -rn "@IfBuildProfile\|@UnlessBuildProfile" calm-hub/src/main/java`) for the same trap.
- For each: confirm the affected deployment actually builds a per-profile artifact (and document that build/release process — it does not currently exist for calm-hub); or replace the annotation with a runtime-evaluated equivalent — `@LookupIfProperty` for `Instance`-mediated lookup (already used correctly for the GitHub-backend beans in `store/github/util`), or an unconditional bean plus an explicit runtime config check, matching the fix applied to `UserAccessValidator`.

## Out of scope

- Re-architecting calm-hub's build/release pipeline to produce per-profile artifacts (an alternative fix, not adopted here).

Start with grep -rn "@IfBuildProfile\|@UnlessBuildProfile" calm-hub/src/main/java, then inspect each usage alongside .github/workflows/docker-publish-calm-hub.yml and calm-hub/deploy/docker-compose.yml. Compare findings with UserAccessValidator, the affected resources, and the GitHub backend beans in store/github/util. Done means every usage is verified against the documented runtime deployment model and receives an appropriate fix or documented per-profile build path.

Written by the indexing model from the issue text.