Design deploy-config-schema + authz-model

[jorisjonkers-dev-agents]

Objective (design-only):

deploy-config-schema — JSON-schema deploy/infra config from fleet.yaml + platform/tooling + render scripts; adapters generate Traefik/Gatus/catalog/Keel/Nomad inputs.
authz-model — shared permission vocabulary (roles/claims/permissions schema + generated constants). NO auth services / OAuth clients / redirect URIs / domain evaluators merged.

Run after platform boundaries are proven. Part of #605.