NTO/Auth + SGO/sgo: add Device, hasVault, isWorkspace -- Bardioc GFS platform dependencies

[boosc]

Summary

This PR adds the Auth-scope platform constructs that the
Bardioc Graph File System (merged in PR #773) depends on but
that did not belong inside the ogit.GFS: namespace:

1. ogit.Auth:Device -- end-user device vertex
2. ogit.Auth:usesDevice -- Account-to-Device verb
3. ogit.Auth:hasVault -- Person-to-DataScope anchor for Personal Vaults
4. ogit.Auth:isWorkspace -- boolean marker on ogit.Auth:Team for self-service workspaces
5. Five new attributes that the Device vertex carries
   (deviceType, securityLevel, fingerprint, lastSeenAt,
   revokedAt)

What is added

New entity

NTO/Auth/entities/Device.ttl -- end-user device that
authenticates against the platform. Distinct from the SGO
ogit:Device, which models datacenter equipment (servers,
sensors, PDUs). The Auth-context device is a smartphone,
laptop, browser session, HSM, or hardware wallet that an
ogit.Auth:Account uses to access platform services.
Mandatory: name, deviceType, securityLevel. Optional:
fingerprint, lastSeenAt, revokedAt. The fingerprint is
indexed.

The Bardioc GFS file model uses Device IDs in
ogit.GFS:restrictToDevices and the Device's securityLevel
in ogit.GFS:minDeviceSecurityLevel to gate per-file device
access.

New verbs

NTO/Auth/verbs/usesDevice.ttl -- Account-to-Device,
many-to-many. One Account may use several devices; one device
may be used by several Accounts (family tablet case).

NTO/Auth/verbs/hasVault.ttl -- Person-to-DataScope. Anchors
a Personal Vault to a Person so the relation survives Account
deactivation (employer change).

New attributes (all on ogit.Auth:)

• deviceType -- fixed-set: mobile,desktop,web,hsm,hardware-wallet.
• securityLevel -- fixed-set: 0,50,80,100 (unverified /
  registered / managed / HSM-or-hardware-wallet).
• fingerprint -- cryptographic device fingerprint (free-form
  string; opaque, indexed at the Device vertex).
• lastSeenAt -- ISO timestamp of most recent successful
  authentication from the device.
• revokedAt -- ISO timestamp on revocation; explicitly
  distinct from ogit.GFS:revokedAt (which lives on
  ogit.GFS:ShareLink in the GFS namespace).
• isWorkspace -- fixed-set boolean: true,false. Marks a
  Team as a self-service Workspace.

All three fixed-set attributes carry
ogit:validation-type "fixed" + ogit:validation-parameter
per the convention used in NTO/Knowledge/attributes/archived.ttl
and the GFS namespace post Calvin's PR #773 review.

Modifications to existing entities

NTO/Auth/entities/Account.ttl -- one new allowed edge:
[ ogit.Auth:usesDevice ogit.Auth:Device ].

NTO/Auth/entities/Team.ttl -- isWorkspace added to
optional-attributes.

SGO/sgo/entities/Person.ttl -- one new allowed edge:
[ ogit.Auth:hasVault ogit.Auth:DataScope ], plus the
missing @prefix ogit.Auth: declaration (the file already
references ogit.Auth:* in the OSINT-extension block but had
no explicit prefix until now).

Decisions for the OGIT review

Decision 1 -- new vertex vs extending SGO:Device

A ogit:Device already exists in SGO/sgo/entities/Device.ttl,
authored by Peter Larem in 2015 with optional attributes
purchaseDate, moveProductionDate, endOfWarranty,
powerConsumption and allowed edges to Timeseries, sensors,
PDUs and UPS units. That is unambiguously datacenter-hardware
modelling. Mixing end-user-device attributes (securityLevel,
fingerprint, lastSeenAt, revokedAt) onto the same class
would produce two disjoint populations of one vertex type
with very different mandatory-attribute expectations. The
choice here is therefore: separate ogit.Auth:Device in the
Auth scope, with the doc strings making the distinction
explicit. Open for redirection if the OGIT review prefers a
single ogit:Device with a discriminator attribute.

Decision 2 -- location of hasVault

hasVault is filed under NTO/Auth/verbs/ because the
relation is primarily auth-relevant: it anchors a Vault scope
(which is an ogit.Auth:DataScope) to a Person. An alternative
location would be SGO/sgo/verbs/, with the prefix
ogit:hasVault, because the source side is ogit:Person.
Per-namespace-ownership preference welcome; the move is
mechanical.

Decision 3 -- coexistence of deviceType

ogit.Mobile:deviceType already exists (free-form string,
authored by Kaushik Gondaliya in 2020, dcterms description
"type of device such as Mobile, FOB..."). The new
ogit.Auth:deviceType is a different concept: a fixed-set
discriminator over the five auth-relevant device categories.
The two coexist in different namespaces because they answer
different questions. Open to renaming the Auth one if the
OGIT review wants stricter naming hygiene; this PR keeps both.

Decision 4 -- revokedAt across namespaces

ogit.Auth:revokedAt and ogit.GFS:revokedAt (added in
PR #773 for ShareLink) are different attributes that happen
to share a local name. Resolving by namespace is fine for
the validator; the PR description here flags the
coincidence in case the OGIT review prefers one to rename.

Diff stats

• 9 new files (1 entity, 2 verbs, 6 attributes)
• 3 modifications to existing files (Account.ttl +1 edge,
  Team.ttl +1 optional attribute, Person.ttl +1 edge + missing
  prefix declaration)
• All files validate cleanly with rdflib 7.6.0
• Local cross-reference check: every class / verb / attribute
  reference in the changed files resolves to a defined OGIT
  construct.

Companion concept

Bardioc GFS Overall Concept Section 6 (Devices) and Section 5
(Vault). Reviewer-friendly Word builds live in the Bardioc
Product Management Dropbox under
Bardioc GFS/Reviewable Deliverables/.