Add AuthorizationManager checks to adapter execute/fetch and tool endpoints. Return 403 on unauthorized and emit AUTHZ audit events.