Check effective authorization

Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.

curl -X POST "https://your-goodmem-server.example.com/v1/access-policy:check" \  -H "Content-Type: application/json" \  -d '{    "checks": [      {        "target": {          "resourceId": "550e8400-e29b-41d4-a716-446655440000"        }      }    ]  }'

{
  "results": [
    {
      "allowed": true
    }
  ]
}