chore(auth): expose observer decisions in runtime logs

[bokelley]

Rollout purpose

Follow-up to #6841 and #6827. The observe-only authorization comparison currently reaches PostHog, but the production PostHog project is not independently accessible from the rollout session. This adds the same comparison outcome to the Fly/Grafana runtime stream so enforcement remains gated on a queryable signal.

Safety

• Observe-only: no authorization, persistence, or response behavior changes.
• Runtime records exclude route/path, credential, identity, email, and organization values.
• Logged fields are limited to decision, method, response status, selector source, allow booleans, and roles.
• Existing kill switch remains ORG_AUTHORIZATION_OBSERVER_ENABLED=false.
• Existing 3-second/zero-retry WorkOS client and five-comparison concurrency cap remain unchanged.

Verification

• Focused observer unit suite: 6/6 passed.
• TypeScript typecheck passed.
• Diff check passed.
• Full local pre-commit was attempted; the server-unit phase reached its repository timeout and an unrelated local C2PA native-binary test failed. GitHub CI is the merge gate.

[aao-secretariat]

Ladon verdict: Approve

Approve — observe-only follow-up to #6841/#6827.

Checked:

• Server-only change (server/src/middleware/organization-authorization-observer.ts + its unit test). No protocol surface (static/schemas/source/**, docs/reference/**, dist/**) touched, so no schema↔docs coherence, oneOf, artifact-immutability, or changeset-scope concern applies. No changeset required.
• New recordAuthorizationObservation helper wraps the four existing captureEvent sites and emits logger.info through an explicit field allowlist (decision, method, response_status, selector_source, explicit_organization, allow booleans, role slugs). Route/path, credential, identity, and organization values are deliberately excluded, matching the stated safety claim.
• No auth-decision behavior changed — this only mirrors the existing shadow comparison into a Fly/Grafana-queryable log line.

Gates: gated_paths: false, high_risk: false, no no-auto-approve team match, no prior decision. Reviewer reported no findings. review_decision: REVIEW_REQUIRED does not force escalation because no gated path or prose hard gate applies. Falls through to row 9.