Fix remaining 403s: Authority envelope middleware + preferences scope

- Add UseIdentityEnvelopeAuthentication() to Authority service, fixing
  /console/tenants 403. Authority was the last service missing it.
- Add ui.preferences.read and ui.preferences.write to OIDC scope request
  in config.json and PlatformServiceOptions, fixing preferences/language 403.
  The scopes existed in Authority but were never requested by the frontend.

All services now have identity envelope middleware:
  Gateway, Platform, Scanner, JobEngine, Timeline, Integrations,
  Concelier, Authority (8/8 complete)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs

@@ -1814,6 +1814,7 @@ app.UseRouting();
 app.UseAuthorityRateLimiterContext();
 app.UseRateLimiter();
 app.UseStellaOpsCors();
+app.UseIdentityEnvelopeAuthentication();
 app.UseAuthentication();
 app.UseAuthorization();
 app.TryUseStellaRouter(routerEnabled);

src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj

@@ -35,6 +35,7 @@
     <ProjectReference Include="../../../__Libraries/StellaOps.Configuration.AuthorityPlugin/StellaOps.Configuration.AuthorityPlugin.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj" />
     <ProjectReference Include="../../../Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj" />
+    <ProjectReference Include="../../../Router/__Libraries/StellaOps.Router.AspNet/StellaOps.Router.AspNet.csproj" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="Pages\*.html" />