Auth Api Strategy Authed

Tell the SDK whether its current token can reach workspace, and if not, whether re-auth would help.

The caller is already authenticated; the only question is whether their token is scoped to the right WorkOS org for this workspace. Returns one of three outcomes:

1. AuthorizedResponse: the token already works for this workspace, the user is signed into it, or is a cradle employee (platform.inspect) whose access is identity-based regionally regardless of org scope.
2. UnauthorizedResponse(can_reauth=True, org_id=...): the token is valid but scoped to the wrong org; the user is a member of the workspace's org, so the SDK should refresh its token against org_id.
3. UnauthorizedResponse(can_reauth=False): the workspace doesn't exist in WorkOS, or the user has no membership to re-scope to, re-auth wouldn't help, so the SDK just proceeds on its existing token.