Add authenticated item/run-scoped endpoint layer with ownership enforcement

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>