calm-hub: NamespaceAccessFilter's request-scoped SecurityIdentity is unsafe off a request thread

`NamespaceAccessFilter` is `@ApplicationScoped` but constructor-injects a request-scoped `SecurityIdentity` (`NamespaceAccessFilter.java:26,30,37`). Works today because every call happens on a request thread, where CDI resolves the identity through its normal-scope proxy.

**Risk:** called from a non-request context — a `@Scheduled` sync tick, or `GitHubStartupInitializer`'s startup thread — and the proxy has no active request to delegate to. Throws `ContextNotActiveException`.

**Fix:** confirm (and document) that this filter is never reachable off a request thread, or restructure so it doesn't depend on request-scoped state outside one.

Read NamespaceAccessFilter.java at lines 26, 30, and 37, then trace its callers, especially the @Scheduled sync tick and GitHubStartupInitializer. Determine whether either path can run without an active request context. Done means the filter is safe in those contexts, or its request-thread-only constraint is clearly documented and enforced.

Written by the indexing model from the issue text.