feat(api): effective-permissions endpoint for a target user

- GET /users/{user}/authorization returns active role + resolved permission
  map with deny precedence, guarded by user.view