Method check_write_with_auth

nodedb/src/control/security/rls/eval.rs:65–91

Write-path RLS check with `$auth.*` support. Evaluates compiled write policies; fail-closed on unresolved auth references. Emits `AuditEvent::RlsRejected` via `emitter` on every denial.

(
        &self,
        tenant_id: u64,
        collection: &str,
        document: &serde_json::Value,
        auth: &AuthContext,
        emitter: &dyn AuditEmitter,
    )

    ///
    /// Emits `AuditEvent::RlsRejected` via `emitter` on every denial.
    pub fn check_write_with_auth(
        &self,
        tenant_id: u64,
        collection: &str,
        document: &serde_json::Value,
        auth: &AuthContext,
        emitter: &dyn AuditEmitter,
    ) -> crate::Result<()> {
        if auth.is_superuser() {
            return Ok(());
        }

        let policies = self.write_policies(tenant_id, collection);
        if policies.is_empty() {
            return Ok(());
        }

        for policy in &policies {
            if let Some(ref compiled) = policy.compiled_predicate {
                check_compiled_write(
                    policy, compiled, document, auth, tenant_id, collection, emitter,
                )?;
            }
        }

        Ok(())
    }
}

fn check_compiled_write(