feat: resource identifiers at gateway boundary

[basauth]

Summary

Implements gateway-owned resource identifier composition to align the basis-gateway implementation with the recently ratified architecture decision from basis-architecture.

Prior to this change, the gateway already supported action composition:

action = read
resource_type = ahu
        ↓
action = read:ahu

However, adapter-normalized requests still carried local resource identifiers while basis-core requires canonical typed resource identifiers:

resource_type = ahu
resource_id = rooftop-1
        ↓
resource_id = ahu:rooftop-1

This PR introduces a dedicated resource composition layer that mirrors existing action composition behavior.

New Behavior

The gateway now supports two valid request styles:

Adapter-normalized requests

{
  "action": "read",
  "resource_type": "ahu",
  "resource_id": "rooftop-1"
}

Gateway composes:

action      = read:ahu
resource_id = ahu:rooftop-1

before invoking basis-core.

Direct kernel-compatible requests

{
  "action": "read:ahu",
  "resource_id": "ahu:rooftop-1"
}

continue to pass through unchanged.

Validation Improvements

The gateway now rejects ambiguous resource identity inputs, including:

• local resource identifiers without a corresponding resource_type
• already-typed resource identifiers combined with resource_type
• conflicting sources of truth for resource identity

Additional Changes

• Added reserved gateway evidence for resource composition.
• Added dedicated resource composition helper module.
• Updated API schema documentation.
• Updated README examples and request-shape documentation.
• Added unit and integration test coverage for all composition and rejection paths.

This change implements the architecture principle:

Adapters normalize.
Gateway composes.
Core evaluates.

for resource identifiers in the same way the gateway already owns action composition.

---

Checklist

Step 1 — Identify affected surfaces

Check every surface this PR touches:

• Authentication or token verification logic (src/basis_gateway/auth/)
• Identity normalization or subject mapping (src/basis_gateway/auth/subject_mapper.py)
• Audit event emission or gateway event vocabulary (src/basis_gateway/audit/)
• Readiness component registration or behavior (src/basis_gateway/readiness.py)
• API request/response schemas (src/basis_gateway/api/schemas.py)
• Environment variable configuration (src/basis_gateway/config.py)
• Correlation ID handling (src/basis_gateway/middleware/)
• Public documentation (README.md, docs/)
• None of the above — this PR does not touch any of these surfaces

Step 2 — Classify the change

• Additive only (new behavior, new config option, new audit event — existing callers unaffected)
• Breaking (changes API contract, removes config support, alters audit event shape, changes authentication behavior)
• Not applicable (docs, tests, refactor only)

---

If the change affects authentication or audit behavior

• New or changed behavior is covered by tests
• Audit event emission for affected paths verified (all pre-evaluation failure paths must emit a gateway event)
• Security model assumptions in SECURITY.md and docs/release-readiness.md still hold

---

If the change modifies basis-core integration

• Change uses only the stable public API (basis-core/docs/public-api.md)
• No direct imports from basis_core internals

---

Tests

Added:

• Resource composition unit tests
• Resource composition integration tests
• Validation and rejection path coverage
• Gateway evidence validation tests
• Audit verification for composed resource identifiers

Updated:

• Existing action composition tests affected by resource composition behavior

Quality gates:

• pytest passes locally (359 passed)
• ruff check passes
• ruff format --check passes
• mypy src passes