Enforce system-only SMART export access

[mikaelweave]

Description

• authorize SMART Bulk Data $export create, status, and cancel only through unconstrained system/ scopes while preserving RBAC and non-SMART behavior
• separate population selection from output authorization: Patient/$export requires Patient access, and Group/{id}/$export requires Group and Patient access, in addition to every output type
• preserve explicit _type subsets and reject scope overreach; when a partial system caller omits _type, infer and persist the authorized resource-type subset instead of requiring wildcard access
• revalidate persisted export level, effective _type, and completed output types for status/cancel while preserving not-found masking and legacy no-_type wildcard behavior
• document the decision and add focused unit, API, integration, and E2E coverage

Related issues

AB#197149

Testing

• Export validator/status/cancel tests on .NET 8 and .NET 9
• API RBAC ordering tests
• SQL create-handler persistence tests
• R4 E2E assembly compilation; focused E2E execution requires local testconfiguration.json

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.57%. Comparing base (05a3b2a) to head (cea06ee).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5674      +/-   ##
==========================================
+ Coverage   77.51%   77.57%   +0.06%     
==========================================
  Files        1005     1006       +1     
  Lines       36950    37016      +66     
  Branches     5606     5621      +15     
==========================================
+ Hits        28640    28714      +74     
+ Misses       6952     6937      -15     
- Partials     1358     1365       +7     

see 11 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.