Honor Access service identities on Workers

[zackbart]

Summary

• accept Cloudflare Access service-token invocations when ctx.access is present but getIdentity() returns no user
• attribute those invocations to the Access application audience and keep them out of operator mutations
• document the required Worker-level Access destination and the hostname-app trap found during the live smoke test

Live verification

A disposable Worker, Worker-level Access app, and one-hour service token were created through the OneMany Cloudflare connector. The final bundle returned 200 for the service token, Managed OAuth discovery and dynamic registration worked, and the authorization request reached the OneMany login. All disposable Cloudflare resources were deleted and verified absent.

Verification

• npm run release:check
• 116 test files, 2,724 passed, 40 skipped
• package and Docker smoke passed
• zero audit findings

Closes #506