Implement resource auth reducer

AGENTS.md

@@ -110,6 +110,8 @@ Roadmap items should be actionable and checkable:
 - Canonical signed-operation envelopes exist for keychain/auth signature
   payloads. The keychain reducer builds an active identity view for admin keys,
   users, devices, nodes, agents, and endpoint bindings.
+- The auth reducer builds a current permission view for resources, grants,
+  groups, and bearer access. Daemon-side enforcement is still roadmap work.
 - Signed peer-card LAN discovery payloads, peer auth over Iroh, cr-sqlite,
   iroh-docs, iroh-gossip, iroh-blobs, Automerge sync, real auth enforcement,
   OpenSSH KRL generation, and Keyhive/BeeKEM-style authorization are future