refactor(client): authorization domain hardening + document per-field validation

Authorization domain:
- Remove 'related' from PolicyValidator VALUE_SOURCES
- Export Cannot from auth components barrel
- Export useCanAny/useCanAll/usePermission from auth hooks barrel
- Extract use-permission hook from permission-guard
- Fix roleKeys.all vs roleKeys.options() cache key inconsistency
- Remove debug code from RoleChartCsvExporter
- Create Authorization Domain documentation in Obsidian vault

Document validation:
- Add requiredFields to DocumentRequirement type
- Update validateDocumentRequirements for per-field checks
- Add required prop to FileUploadField with red asterisk indicator
- Mark all identity upload fields required (national-card, birth-certificate)
- Show per-field errors in review tab validation summary