Switch from mattn/go-sqlite3 (CGO) to modernc.org/sqlite (pure Go) for auth, audit, and notification queue storage. This enables SQLite functionality on arm64 Docker images which are built with CGO_ENABLED=0. Related to #1140
- Add policy evaluator for fine-grained access control - Implement SQLite-backed auth manager for user/role persistence - Support role-based permissions evaluation