feat(httpauth)!: promote to v1.0.0 — add ChainPermissionProvider, bump rbac to v1.0.0

Add NewChainPermissionProvider: tries each rbac.PermissionProvider in order,
returns the first non-zero mask, propagates errors immediately. Primary use case:
ClaimsPermissionProvider (JWT fast-path, no DB call) chained with
CachedPermissionProvider (DB fallback). Bump rbac dependency to v1.0.0.
API committed as stable.

CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this module will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0] — 2026-05-08
+
+### Added
+
+- `NewChainPermissionProvider(providers ...rbac.PermissionProvider) rbac.PermissionProvider` —
+  tries each provider in order and returns the first non-zero mask; propagates errors
+  immediately without consulting subsequent providers; primary use case is a JWT claims
+  fast-path (`ClaimsPermissionProvider`) chained with a DB-backed fallback
+  (`CachedPermissionProvider`)
+
+### Changed
+
+- Dependency `code.nochebuena.dev/go/rbac` bumped from v0.9.0 to v1.0.0
+
+### Unchanged
+
+`SetTokenData`, `EnrichmentMiddleware`, `AuthzMiddleware`, `IdentityEnricher`,
+`WithTenantHeader`, `Cache`, `NewClaimsPermissionProvider`, and
+`NewCachedPermissionProvider` are API-compatible with v0.1.0.
+
+[1.0.0]: https://code.nochebuena.dev/go/httpauth/releases/tag/v1.0.0
+
 ## [0.1.0] - 2026-05-08
 
 ### Added