Enforce Query Policy across every generated query family #35

IRequestPolicy is injectable, but generated list/page/facet/stream execution currently reaches the data service without applying it.

Acceptance:

• UserContext deep-clones and authorizes root and nested entity query graphs;
• generated list/one/rows/page/facet/stream paths use an authorized snapshot;
• denial reaches no provider and caller-owned queries remain unchanged;
• full solution tests and a runnable example pass.