feat: add FastAPI semantic assurance profile

[fraware]

Purpose

Add the first source-grounded Assurance IR extractor for application-level protected effects.

This profile is deliberately narrower than the existing FastAPI authorization profile. It trusts only repository-declared semantic anchors and represents unsupported semantics explicitly.

Trusted inputs

The repository supplies:

• principal dependency names;
• authorization-call signatures and argument positions;
• protected sink functions and their semantic effects.

No LLM output or name heuristic becomes trusted policy.

Extracted semantics

For supported direct FastAPI handlers the compiler records:

• route entrypoint;
• principal origin;
• authorization guard principal/effect/resource;
• protected sink effect/resource;
• principal/effect/resource binding constraints;
• source provenance and abstraction coverage;
• semantic paths suitable for the protected_effect_integrity compiler introduced in feat: compile protected-effect integrity obligations #31.

Conservative boundaries

The initial profile explicitly downgrades coverage for:

• conditional/loop/try/with/match control flow;
• nested callables;
• missing or multiple principal dependencies;
• dynamic route paths or router prefixes;
• include_router mounting that is not yet modeled;
• dynamic or malformed authorization arguments;
• unsupported sink-resource extraction.

Unsupported behavior becomes Assurance IR unknowns; it does not silently become an allow result.

Example property path

authorize(user, "billing.invoice.refund", invoice)

followed by

issue_refund(invoice)

produces equal principal/effect/resource bindings.

If the sink instead receives other_invoice, resource binding is explicitly unknown, so downstream verification cannot claim equivalence.

Stack

This is a draft stacked on #31, which is stacked on #30. It targets feat/protected-effect-integrity, not main, to preserve the current release-candidate evidence boundary.