perf: collapse dashboard and lease read-path round trips

Authorization funnel: one statement per workspace-scoped request. The
effective-tenant resolve (user row first, token claim as fallback), the
workspace-ownership check, and the Row-Level Security (RLS) context write
now ride one statement; set_config sits in a WHERE-gated SELECT list, so a
denied request still writes no context. Verdicts are unchanged for every
principal mode.

Fleet chat: GET .../fleets/{fleet_id}/messages returns the newest turns with
bodies in one keyset page, so the chat view stops issuing an events-list read
plus one detail read per turn. Pages are byte-budgeted (the newest turn always
ships) rather than refused, and the fleet-detail view loaders now start from
route params beside the detail read instead of behind it.

Single-statement lists: the api-keys page carries its tenant total, and the
tenant-workspaces page folds its principal-tenant resolve into the page read.

Lease path: the runner degraded flag rides the auth lookup onto the principal
(the standalone read retires), claimFleet joins core.fleets with
core.fleet_sessions on one connection, the crash-recovery execution clear is
guarded so the steady state writes nothing, and the credential resolve loads
every declared name in one vault read.

Wire shapes and authorization verdicts are unchanged throughout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>