Platform-wide authorization and a shared SDK across every portal

Every action on the platform now goes through one authorization engine, with a superadmin console to author roles and see exactly what they grant.

MagOneAI now has a single, platform-wide authorization system (magauth): an action registry, roles as permission bundles, groups as user sets, and per-user overrides where a deny always wins. It ships enabled by default and replaces the deployment-wide flags and host maps that used to make this decision.

Superadmins get an Access Control console to author roles and groups, start from presets, clone an existing role, and see an effective-access grid that derives access the same way the policy engine does. Execution visibility is now one of those policy decisions — a run is confined to the person who started it, admins excepted — and role assignments can be scoped to a single project.

Also in this release:

Apps Catalog: register a portal with its own origin in superadmin; access is resolved from the request origin instead of a host map
code_execute as a built-in system tool inside agents and TOOL nodes, with a compiler-style editor and a replay-safe sandbox
Shared SDK and UI packages (@magurelabs/magoneai-sdk, @magurelabs/magoneai-ui) now back Studio, Hub, and Superadmin from one source instead of three forked copies
A denied request now shows an explicit refusal instead of an empty list or a false "unlimited" reading

Agent trajectory capture, added last release, is now opt-in and defaults to off at the platform level.