Resync Application Authorization

Re-apply an application's authorization tuples through the service.

Re-applies every role bundle's catalog tuples and backfills the per-scope module_instance plumbing for the full catalog module set on every installed scope. The transactional write path on registration / operator-edit / boot-seed already self-heals catalog edges; this endpoint exists so an operator can force a re-apply on demand when something has drifted (manual FGA tampering, schema migration, a module added before the DOCK-259 fan-out fix) without waiting for the next write or a re-install.