fix(authz): reject Surface: system from HTTP requests (B8)

System means "the plane itself, in-process" (router, coordinator, adapters,
lease-expiry reclaim) and is unconditionally FullControl with no token
gate. But it was reachable straight from the X-Orchestra-Surface HTTP
header, both in authz.HTTP's token check and in main.go's own `surface`
closure (which every handler actually calls to authorize an event — it
re-parses the header independently of what the HTTP middleware resolved).
Since no deployment configures ORCHESTRA_SYSTEM_TOKEN (no legitimate HTTP
caller should ever need one), tokens[System] is always "", so the token
check was skipped entirely: any LAN request with
"X-Orchestra-Surface: system" got unauthenticated full control to emit any
event on any task.

Both the authz.HTTP middleware and main.go's `surface` closure now
downgrade System to Web before doing anything else with it, so the header
can never resolve to System over HTTP regardless of token config.

AUDIT.md B8.

cmd/orchestra/main.go

@@ -142,7 +142,11 @@ func main() {
 	providerHealth := map[string]*provider.Supervisor{}
 	surface := func(r *http.Request) authz.Surface {
 		v := authz.ParseSurface(r.Header.Get("X-Orchestra-Surface"))
-		if v == "" {
+		if v == "" || v == authz.System {
+			// System means "the plane itself, in-process" and is always
+			// FullControl with no token gate (AUDIT.md B8) — it must never
+			// be constructible from an HTTP request, or any LAN caller
+			// declaring this header gets unauthenticated full control.
 			return authz.Web
 		}
 		return v