docs(server): require admin for tenant-scoped secret writes (RIG-3655)

[rigel-mintaka]

This PR is part of a stack containing 7 PRs:

1. main
2. docs(server): scope user secrets per tenant, user, and agent (RIG-3655) #1110
3. feat(envelope): AES-256-GCM seam for user-secret values (RIG-3655 T1) #1111
4. feat(store): scope and encrypt user secrets at rest (RIG-3655 T2) #1118
5. feat(secrets): add the DB-backed StoreResolver (RIG-3655 T3) #1138
6. "docs(server): require admin for tenant-scoped secret writes (RIG-3655)" (this PR)
7. feat(server): resolve the at-rest master key at boot (RIG-3655 T4) #1146
8. test(server): prove the armed forge-secret boot path with the real resolver (RIG-3656) #1155

Matt ruled the record's open write-authz question: a plain user may not
write a tenant-scoped row. The check reuses the existing
store.UserRoleAdmin elevation rather than adding a permission concept,
and lands in the store door beside DL-360's referential checks. Reads
stay asymmetric on purpose -- resolving a shared tenant value is the
feature; writing one is privileged.

Records D8 and DL-363, and narrows the remaining open question to the
wire surface, which is a public-proto fork.

Refs RIG-3655

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-3655

[github-actions]

Compass engineering docs preview: https://compass-server-rig-3655-d8-a.compass-eng-docs.pages.dev

Deployed from compass-server/rig-3655-d8-admin-writes at b5d781e.

Changed pages:

• docs/designs/DECISIONS.md
• docs/designs/server/compass-user-secret-store.md

[trunk-io]

This pull request was merged into main as part of stacked PR 1155.