Implement authorization and control surfaces

internal/authz/authz_test.go

@@ -0,0 +1,15 @@
+package authz
+
+import "testing"
+
+func TestSurfaceCapabilities(t *testing.T) {
+	if Telegram.CanEmit("TaskCreated") || Ntfy.CanEmit("ApprovalRequested") {
+		t.Fatal("notify surface emitted an event")
+	}
+	if !TUI.CanEmit("TaskCreated") {
+		t.Fatal("control surface cannot emit")
+	}
+	if !MCP.CanEmit("ApprovalRequested") || MCP.CanEmit("TaskCreated") {
+		t.Fatal("mcp gate is wrong")
+	}
+}