hush broker: authorize socket peers with an allowed-uid policy #76

Follow-up from PR Lens on #75 and #78, under ADR 0002.

The broker accepts connections on a 0666 local socket. Kernel peer credentials identify callers. They do not authorize which callers may use secrets. Catalog answers any connected local caller, and a non-root caller can request any secret for a child run.

The user explicitly chose to preserve the accepted local-user trust scope in PR #78 and document it. Caller allowlisting remains a separate follow-up. It is not part of the current PR #78 review fix.

Add an allowed_uids list to daemon policy and check the authenticated peer before each request, with audited refusals. Settle the missing-policy default and installation configuration as part of that separate change. Test refusal before catalog or secret-fetch side effects, including the run and human-operation paths.