fix(files): enforce record and field authorization

[rrrodzilla]

File operations now enforce the same record policy and field permissions used by entity access before issuing storage access or running mutation hooks. Upload and confirmation require update permission. The shared tenant middleware continues to supply the selected program context, including accounts with multiple memberships.

Eight route regressions cover tenant and owner boundaries, selected/missing/unauthorized program context, field read/write restrictions, authenticated access and administrator behavior. Package patch versions advance the acton crate to 0.36.1 and CLI to 0.37.3. A separate small commit fixes an existing loop lint exposed by Rust 1.97 without suppression.

Validation:

• 654 acton tests passed; four existing external-MinIO tests skipped.
• All-target acton and PostgreSQL CLI Clippy passed with zero warnings.
• PostgreSQL release CLI built successfully with Rust 1.97.1.
• An isolated live PostgreSQL/S3-compatible fixture verified permitted result bytes, cross-program denial for read/upload/confirmation, and selected-program isolation for a multi-membership account.

No production deployment is included in this PR.