…ation in existing instructions (#3206)

> **Permission rollout — stacked PR series.** Review/merge order:
> 1. [#3206 — enforce Permission-based authorization in existing
instructions](#3206)
> 2. [#3942 — define topology/resource/index permission flags
(3/4)](#3942) — stacked on
#3206
> 3. [#3943 — enforce topology/resource/index permission flags
(4/4)](#3943) — stacked on
#3942
>
> Retarget each PR's base to `main` as its upstream merges.
> **👉 You are here: #3206 (base of the follow-up stack).**

## Summary of Changes
- Wire `authorize()` into the privileged instruction processors that
gate on it: `accesspass/{close,set}` (`ACCESS_PASS_ADMIN`) and
`user/{delete,requestban}` (`USER_ADMIN`). Each appends the caller's
Permission PDA as an optional trailing account, read last by
`authorize()`. The user owner can still delete their own account without
a Permission account.
- Add `execute_authorized_transaction` (and its `_quiet` variant) to the
Rust SDK. They share the existing `execute_transaction_inner` builder,
so compute-budget, preflight, and error-reporting behavior are identical
to `execute_transaction`; the only difference is the optional trailing
Permission PDA, which is resolved at most once per client (retried on
transient RPC errors, then memoized).
- Switch the affected SDK commands (`accesspass/{close,set}`,
`user/{delete,requestban}`, `tenant/delete`, and the `permission/*` CRUD
commands) to `execute_authorized_transaction` so the Permission account
is included transparently.
- Drop the retired activator authority from the
`USER_ADMIN`/`NETWORK_ADMIN`/`MULTICAST_ADMIN` legacy fallbacks.
`ACCESS_PASS_ADMIN` legacy authority (foundation + sentinel + feed) is
applied uniformly across its instructions and documented in
`authorize.rs`.

## Testing Verification
- New DZClient-level tests assert the assembled instruction list carries
the protocol-max compute-budget/heap-frame requests and that the
Permission account is appended after `payer`+`system`, with and without
an on-chain permission account.
- `authorize` unit tests cover the legacy fallbacks (including the
activator now being denied for the admin roles) and the
Permission-account path (PDA, ownership, discriminator, status, and flag
checks).
- `cargo test -p doublezero_sdk` and `cargo test -p
doublezero-serviceability` pass.

Related RFC/series: the Permission account and `authorize()` mechanism
land in the earlier PRs of this series; this PR enforces them in
existing instructions.

…ermission flags (#3943)

> **Permission rollout — stacked PR series.** Review/merge order:
> 1. [#3206 — enforce Permission-based authorization in existing
instructions](#3206)
> 2. [#3942 — define topology/resource/index permission flags
(3/4)](#3942) — stacked on
#3206
> 3. [#3943 — enforce topology/resource/index permission flags
(4/4)](#3943) — stacked on
#3942
>
> Retarget each PR's base to `main` as its upstream merges.
> **👉 You are here: #3943 (PR 4/4).**

## Summary

- Replaces the direct `foundation_allowlist` checks with `authorize()`
in topology (`create` / `delete` / `clear` / `assign-node-segments`) →
`TOPOLOGY_ADMIN`, resource (`create` / `allocate` / `deallocate` /
`close`) → `RESOURCE_ADMIN`, and index (`create` / `delete`) →
`INDEX_ADMIN`.
- The `Permission` account is read as the optional trailing account; the
variable-length `clear` and `assign-node-segments` layouts detect it by
PDA match before consuming their link/device lists.
- Backward compatible: with no `Permission` account the legacy
foundation path still applies, so existing callers (controlplane,
current SDK) keep working.
- Switches the corresponding SDK commands to
`execute_authorized_transaction` so the payer's `Permission` PDA is
appended when it exists onchain.

**Behavior change:** the topology instructions now reject unauthorized
callers with `NotAllowed` (`Custom(8)`) instead of `Unauthorized`
(`Custom(22)`), since `authorize()` is the single rejection path;
affected tests updated.

Depends on the 3/4 PR (stacked).

## Testing Verification

- New end-to-end test
`test_topology_create_with_permission_account_allowed`: a non-foundation
key holding `TOPOLOGY_ADMIN` creates a topology via its `Permission`
account — exercises the new authorization path through a real processor.
- topology / index / resource / permission integration suites pass;
topology error-code assertions updated `Unauthorized` → `NotAllowed`.

Reference:
`smartcontract/programs/doublezero-serviceability/PERMISSION.md`