feat(api/v2): enforce X-Agent-Role on every flow router

Route layer now rejects 403 if the role doesn't match the router's
allowed set. Choreographer still re-checks role per verb where needed,
but defense in depth means a future verb that forgets the role check
doesn't leak. Auditor router also gated.

tests/unit/api/routes/v2/test_flow_board.py

@@ -20,7 +20,7 @@ _HTTP_422 = 422
 
 _AGENT_ID = str(uuid4())
 _TASK_ID = str(uuid4())
-_HEADERS = {"X-Agent-ID": _AGENT_ID}
+_HEADERS = {"X-Agent-ID": _AGENT_ID, "X-Agent-Role": "product_owner"}
 
 
 def _make_envelope(