bearer: say what IsRefusal does not answer for

A service whose own refusals do not wrap these sentinels sends its "bad
token" into the else branch of the guard the doc suggests, and answers 503 to
a caller whose credential really was the problem. One of the six hit this while
adopting it.

ecore: the gaps the third adoption pass found

Five services adopted the new packages today and each hit the same edges.

bearer.IsRefusal: a service's resolver returns more than this package's
vocabulary — the Postgres lookup it had to make, an expired context, a bug —
and StatusFor's default answers those 401, which tells a caller to re-mint a
token that was never the problem. Every service that wrapped the table spelled
out the sentinel list to guard the delegation; now it does not have to.

instconf.Key.Because: three services kept their own hand-written config
checker rather than lose the sentence that says WHY a key is required
("crypto.InitCrypto exits without it"). Require reported the names and nothing
an operator could act on, so nobody used it.

logging.DefaultsWithoutDebugFlag: a migration CLI passes -d to brant, where it
means --dialect and takes a value, so `coversrht-migrate -d postgres` arrived
as a request for debug logging — silently, because the probe sees the flag and
never the value.

assets.DirFS: os.DirFS("") does not mean "no assets", it means "serve the
filesystem root", and it is one unset config key away. dolt wrote the guard;
the other five would each have to see it happen first.

pages.APIMessage: the REST half of every service keeps its 404 body
byte-identical on purpose, so it could not adopt the shared refusal installer,
whose messages are page sentences. The same table now answers in both
registers.

bearer: mint the internal authorization through internalauth

This package assembled the header by hand — json.Marshal of an auth.InternalAuth
plus "Internal " and a fernet seal — two files away from the package whose whole
purpose is to hold both ends of that handshake. It is the same drift internalauth
was hoisted to end, sitting inside the library that hoisted it: a change to the
payload shape here would have gone unnoticed by every Guard on the instance until
a revocation check started failing.

bearer, pages: the refusal table and the form read that must not drift

bench wrote the bearer refusal switch three times in one repo — REST, MCP and
its resolver — and each copy re-decides the arm that matters: ErrUnavailable
is 503, never 401. Reading an unreachable token daemon as "revoked" tells
every CI job on the instance its credential is bad for as long as tokens.sr.ht
takes to restart. That warning has lived in this repo's README as prose, where
it cannot be imported; StatusFor puts it in code, and its default sends an
unrecognised failure to 401 so a forgotten arm refuses a request rather than
declaring the service unwell.

FormValues returns r.PostForm and never r.Form. r.Form merges the query string
into the body's values, so a mutation could be driven from a URL somebody was
linked to — the one request the same-origin guard cannot fault, because it did
come from our own page. The difference between the safe version and the hole
is one character in a field name, in a function every service with a form
writes for itself.

bearer: split the grant check out of validation

A sourcehut service resolves identity once per request in middleware, upstream
of the router — that is where the cookie plane and the bearer plane meet and
where a principal is put on the context — and at that point nothing knows which
route will run, so nothing knows the action. The action is known one layer down,
in the handler.

Validate insisted on both at once, which left every adopting service two bad
options: invent an action before it has one, or lift its bearer plane out of the
middleware every other plane goes through. The second is how a surface ends up
with two different ideas of who is calling.

So Inspect answers steps 1, 2 and 4 — who, what may they do, is it still live —
and Token.Authorize is step 3, asked where the action finally exists. Validate
is unchanged for callers that know both at one point.

It keeps its own ordering rather than becoming Inspect+Authorize: step 3 before
step 4 means a token that does not carry the grant is refused without a round
trip to the daemon, and a test pins that. Inspect cannot keep that ordering,
having no action to refuse on, and that is the one cost of the split — written
down at both call sites.

bearer: the shared working-token validator of SPEC ch. 6