feat(auth): add GET /v1/me/can capability probe and OIDC token-refresh logging

[hyp3rd]

Closes RFC 0003 open questions 5 & 6.

• Add GET /v1/me/can?capability=<name> server endpoint that returns whether the resolved identity holds the requested capability. Unknown capability strings return 400 BAD_REQUEST rather than silently degrading to allowed=false, surfacing typos as client errors. Recognised capabilities are a closed set: cache.read, cache.write, cache.admin.

• Add Identity.HasCapability(name string) to pkg/httpauth/policy.go as the single authoritative scope-to-capability check shared by both the server handler and the SDK.

• Add Client.Can(ctx, capability) SDK method mirroring the new endpoint. Denial returns (false, nil); spelling mistakes return (false, ErrBadRequest), making the typo visible at the call site.

• Add loggingTokenSource in pkg/client/oidc_logging.go wrapping the oauth2.TokenSource used by WithOIDCClientCredentials. Emits one "oidc token rotated" slog Info line per real rotation (expiry change); cached returns stay silent. Holds a *Client reference so WithLogger applied after WithOIDCClientCredentials still reaches the log surface.

• Extend openapi.yaml with the /v1/me/can operation and CanResponse schema.

• Add 9 new tests: 3 handler tests (me_test.go), 3 SDK tests (client_test.go), 3 unit tests (oidc_logging_test.go).

• Update docs/client-sdk.md and CHANGELOG.md with new sections for capability probing and token-refresh visibility.

• Fix Makefile pre-commit target to activate the pyenv virtualenv before running hooks.