Admit events [trace grant]

Authenticated by a trace grant token (Bearer tgr_…), not an API key. At most 256 events, 64 KiB each, 4 MiB per request. Each event is judged on its own: the same event id and content returns its first receipt; different content, a session outside the workspace, another source's span, a changed parent, a parent cycle or content outside the grant's scopes is refused. Returns 404 when the TASK_TRACES switch is off for the workspace and 503 not_migrated before the tables exist.