fix(auth): when auth.enforce is false, still run auth checks as dry-run

[matt-codecov]

currently when auth.enforce is false we skip auth entirely. in order to safely roll auth out, we want to change that. with this PR, auth logic will always run and auth.enforce simply controls whether failure should result in the request being rejected

there is still some danger associated with rolling out auth (startup failure if we mess up secret mounting, for example) but now we'll be able to ensure sentry/launchpad/relay auth integration is working end-to-end before actually flipping the switch

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Double debug logging on authorization check failures

Low Severity

When AuthContext::assert_authorized in context.rs fails, it emits a tracing::debug! with message "Authorization failed". Then inspect_err in assert_authorized calls err.log(), which emits a second tracing::debug! with message "Authorization failure" and increments a counter. The counter is new and valuable, but the debug log is redundant — every per-operation auth failure now produces two debug entries with overlapping information.

Additional Locations (1)

• objectstore-server/src/auth/error.rs#L42-L49