feat(rbac)!: promote to v1.0.0 — MaxPermission constant, audit logging policy

Add MaxPermission constant (62) to make the valid bit range explicit in the API.
Document in PermissionProvider that audit logging belongs in the application layer.
API committed as stable: Identity, PermissionMask, context helpers, and
PermissionProvider interface are unchanged from v0.9.0.

provider.go

@@ -11,6 +11,10 @@ import "context"
 // The resource string identifies what is being accessed (e.g. "orders",
 // "invoices"). Its meaning is defined by the application.
 //
+// Audit logging of permission checks is out of scope for this package.
+// Log denials and grants inside your PermissionProvider implementation or in
+// the middleware layer that calls it.
+//
 // Example in-memory implementation for tests:
 //
 //	type staticProvider struct {