Authorization testing

A Forge resolver rewrote whatever page the caller named, using the app's own permissions

The gate is a pure function that imports nothing and runs under plain node. The proof it works is a six-case suite scoring 1 of 6 against the ungated resolver and 6 of 6 once the gate is wired in.