feat: add database-refreshed identity authorization

backend/README.md

@@ -7,7 +7,8 @@ unchanged until later route-by-route cutover work passes the shared contracts.
 
 Implemented Modules:
 
-- `identity`: legacy `zhinian_session` HMAC, parsing, and chunking contract.
+- `identity`: legacy `zhinian_session` HMAC/chunking plus database-refreshed
+  account, organization, role, and `sessionVersion` authorization.
 - `postgres`: fail-closed configuration, verified-CA TLS, readiness, and calls
   to the existing atomic claim and wallet PostgreSQL functions.
 - `httpapi`: process health and database readiness handlers.
@@ -32,3 +33,7 @@ ZHINIAN_DATA_BACKEND=local GO_BACKEND_PORT=8080 ./backend/zhinian-api
 
 Only `/api/health` and `/api/ready` are implemented in this foundation. No
 Ingress, Docker, ACK, Secret, or Worker ownership has moved to Go yet.
+
+The Identity resolver and PostgreSQL authorization-snapshot Adapter are
+implemented and tested, but no Go login or current-user HTTP route is exposed
+yet. Route ownership remains with Next.js until a later path-level cutover.