docs(rbac): document CAS coverage gaps

[sriaradhyula]

Description

Add a living inventory of Centralized Authorization Service (CAS) coverage and the remaining direct-OpenFGA migration gaps.

The documentation:

• distinguishes CAS-backed runtime paths from direct OpenFGA decisions and relationship mutations;
• documents the AgentGateway, legacy BFF, Slack/Webex, RAG, and lifecycle-mutation gaps;
• separates intentional OpenFGA administration from product-policy bypasses;
• provides reproducible source inventory commands and a prioritized migration order;
• corrects the CAS architecture page to reflect the current Dynamic Agents and BFF migration status.

This makes the remaining authorization work reviewable without implying that all direct OpenFGA usage is a defect.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

Not applicable; this PR changes documentation only.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (not applicable; no tracking issue)
• I have verified this change is not present in other open pull requests
• Functionality is documented
• All code style checks pass
• New code contribution is covered by automated tests (not applicable; no code changes)
• All new and existing relevant tests pass

Validation

• git diff --check upstream/main...HEAD
• cd docs && npm run build

The documentation build succeeds. It reports five pre-existing broken-anchor warnings on unrelated pages.

[github-actions]

✅ No proprietary content detected. This PR is clear for review!