feat(coordinator): worker trust tiers (C1) — enroll volunteers, quarantine untrusted

- migration 0012: workers.owner_id + trust_level (trusted/untrusted)
- verifier/authctx read the JWT verified claim; IsTrusted() = admin||verified
- /workers/register resolves trust from auth: service token or verified/admin
  JWT -> trusted; plain user JWT -> untrusted, tagged with owner_id
- claim quarantines untrusted workers (no tasks) until quorum (C2) lands
- unit tests for trust resolution, quarantine, and the verified claim

Additive and backward compatible: shared-token workers stay trusted, so the
existing worker flow and team tests are unchanged. Quorum verification (C2)
is deferred.

coordinator/internal/authctx/authctx.go

@@ -15,13 +15,19 @@ import (
 // Requester at all (From returns ok=false), which is how worker traffic and
 // legacy unauthenticated-user traffic stay owner-less.
 type Requester struct {
-	UserID uuid.UUID
-	Role   string
+	UserID   uuid.UUID
+	Role     string
+	Verified bool
 }
 
 // IsAdmin reports whether the requester may act on any user's jobs.
 func (r Requester) IsAdmin() bool { return r.Role == "admin" }
 
+// IsTrusted reports whether workers this requester registers produce results
+// the coordinator accepts without quorum. Admins and verified contributors are
+// trusted; a plain unverified user is not.
+func (r Requester) IsTrusted() bool { return r.IsAdmin() || r.Verified }
+
 type ctxKey struct{}
 
 // With returns a copy of ctx carrying r.