feat(federation): optional per-product inline session policy

Part of the Federated backend authentication epic (proxy-side).

What

For connections using subject_scope = product, optionally pass an inline session policy on AssumeRoleWithWebIdentity that scopes the session to {base_prefix}{mirror_prefix}*. This adds a proxy-side blast-radius control on top of the customer's trust policy.

Why it's "free" here

A product-scoped connection already pays per-product cache cardinality, so adding a per-product session policy doesn't change the cache key class. For connection/account scope, mint no session policy (keeps the credential broad and cacheable) — the Source-owned bucket relies on Layer-1 authz + path-prefix rewriting instead.

Acceptance

• product scope → session policy scoping to the product prefix
• connection/account scope → no session policy
• Session-policy fingerprint included in the cache key
• Test: session policy denies access outside the product prefix

Start by locating the proxy-side AssumeRoleWithWebIdentity flow and the cache-key construction, then trace how product, connection, and account scopes are handled. Done means product scope sends a prefix-limited session policy with its fingerprint in the cache key, while connection and account scopes send none, with a test denying access outside the product prefix.