feat(auth): add certification stalled count canary

[bokelley]

Summary

• add the default-off organization_certification_stalled_count_read boundary
• guard only GET /api/organizations/:orgId/certification-stalled
• preserve the shipped canonical-membership path while disabled
• use exact authenticated-credential authorization with an explicit member minimum when enabled
• retain the existing count-only response and block learner reads on forbidden or unavailable decisions
• add audited setting, admin UI, isolation, persistence, route, ceiling-rejection, and candidate-only rollback coverage

fly.toml is intentionally unchanged, so deployment cannot enable this boundary. This is a fresh narrow PR for #6827 and does not use #6839.

Verification

• focused authorization suite: 104/104 passing
• independent code review: approved
• independent security review: approved for this GET-only boundary
• independent test review: approved after strengthening runtime-isolation and real-markup assertions
• git diff --check: clean

The local full server suite completed with 8,708 passing tests and five failures in three unrelated existing areas. One worker-bound failure reproduced alone without this boundary's test files. Local typecheck is also blocked by two existing errors in an untouched reporting source file. The pre-push storyboard runner could not obtain its local capability declaration. None of those failures involve files in this diff; this PR's GitHub checks remain the authoritative merge gate.

Rollout

1. Merge and deploy with the boundary outside the environment ceiling and runtime setting.
2. Verify convergence and complete a disabled soak.
3. Stage only the environment ceiling in a separate PR/deploy.
4. Re-soak disabled, then activate only this boundary through the audited runtime setting.
5. Run approved-member and synthetic-negative probes, immediate watch, and a 24-hour cumulative exposure hold.
6. Fast rollback removes only organization_certification_stalled_count_read.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, precedent-following change.

This PR adds the sixth organization-authorization boundary (organization_certification_stalled_count_read) and routes GET /:orgId/certification-stalled through the existing canary enforcement path, mirroring the five already-shipped boundaries. The reviewer verified route control flow, changeset scope (correctly omitted — admin/auth/operational surface, no protocol/schema/dist touch), certification-route floor, operational readiness, and comprehensive test coverage.

Decision-table walk:

• Row 1 (critical/high): no findings — skip.
• Row 2 (gated_paths): false — skip.
• Row 3 (high-risk deleted): high_risk is true but the only reason is server/src/routes/certification.ts (modified) — no deletion — skip.
• Row 4 (medium data-loss/schema/infra): no findings — skip.
• Row 5 (high-risk modified + medium finding): file is modified but there are zero medium findings — skip.
• Row 6 (sticky escalate): no prior decision — skip.
• Row 7 (no-auto-approve team): no team match — skip.
• Row 8 (≥3 medium): zero medium — skip.
• Row 9: approve.

Note: the certification route addition is read-only (count read of stalled certifications), not a user self-report of an exam score, so the critical REST-self-report rule does not apply. review_decision is REVIEW_REQUIRED but gated_paths is false, so no hard gate blocks approval.