Authorize flows before evaluating feature cohorts

Observation (2026-09-05, source: COR-4057 implementation/review in e3-solutions/theft PR #798): evaluate flow authorization and feature eligibility before loading configuration or assigning a deterministic canary cohort. This keeps invalid or inactive requests from probing rollout behavior and makes secret-free selection metadata an explicit server/client boundary. Independent review caught this ordering issue; route tests now assert config and selection are not called for unauthorized or unconfigured flows.