fix: store auth filter enforcement (#2597)

## Summary

Fixes the store API authorization filter issue flagged by Corridor by
capturing and applying `handleAuthEvent()` filters for store operations.

Changes:
- Capture auth filters for `list_namespaces`, `search`, `put`, `delete`,
and `get` store endpoints.
- Evaluate filters against store item value fields plus synthetic
`namespace` and `key` metadata.
- Use the mutable value returned by auth handlers for `store:put`,
allowing handlers to inject ownership fields before persistence.
- Filter list/search responses before returning them, applying
pagination after auth filtering when filters are present.
- Return 404 for existing items that are outside auth scope and 403 for
unauthorized new/missing write targets.
- Add auth test coverage for filter-based namespace isolation on broad
store search/list calls.

## Security

Addresses Corridor category 3: High/Medium store API authorization
filters discarded.

Primary finding cluster:
- Store search/get/put/delete/list_namespaces discarded
`handleAuthEvent()` filters, preventing item/namespace-level
authorization enforcement.

## Test plan

- `git diff --check` passed.
- Targeted test/typecheck not run locally because this sandbox did not
have dependencies installed, and Socket Firewall (`sfw`) installation
failed while downloading the required binary from GitHub with HTTP 502.
CI should run the package tests on the PR.

---------

Co-authored-by: Langster Security Agent <john@langchain.dev>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>