Migrate db, auth, and config to mcdsl

- db.Open: delegate to mcdsl/db.Open
- db.Migrate: rewrite migrations as mcdsl/db.Migration SQL strings,
  delegate to mcdsl/db.Migrate; keep SchemaVersion via mcdsl
- auth: thin shim wrapping mcdsl/auth.Authenticator, keeps Claims
  type (with Subject, AccountType, Roles) for policy engine compat;
  delete cache.go (handled by mcdsl/auth); add ErrForbidden
- config: embed mcdsl/config.Base for standard sections (Server with
  Duration fields, Database, MCIAS, Log); keep StorageConfig and
  WebConfig as MCR-specific; use mcdsl/config.Load[T] + Validator
- WriteTimeout now defaults to 30s (mcdsl default, was 0)
- All existing tests pass (auth tests rewritten for new shim API,
  cache expiry test removed — caching tested in mcdsl)
- Net -464 lines

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config_test.go

@@ -69,8 +69,8 @@ func TestLoadDefaults(t *testing.T) {
 	if cfg.Server.ReadTimeout.Seconds() != 30 {
 		t.Fatalf("read_timeout: got %v, want 30s", cfg.Server.ReadTimeout)
 	}
-	if cfg.Server.WriteTimeout != 0 {
-		t.Fatalf("write_timeout: got %v, want 0", cfg.Server.WriteTimeout)
+	if cfg.Server.WriteTimeout.Seconds() != 30 {
+		t.Fatalf("write_timeout: got %v, want 30s (mcdsl default)", cfg.Server.WriteTimeout)
 	}
 	if cfg.Server.IdleTimeout.Seconds() != 120 {
 		t.Fatalf("idle_timeout: got %v, want 120s", cfg.Server.IdleTimeout)