Config: per-route suppressions with reasons, coverage-class overrides, and adapter toggles

[bjcorder]

Problem

There is no way to suppress a known-accepted finding for a specific route, override a classification the team has manually verified, or disable an adapter that misfires on a particular repo. Teams adopting AuthMap in CI (especially with --enforce-style blocking and drift gates) need an auditable acknowledgment mechanism — today the only options are editing global rules or living with permanent noise, which erodes trust in the report.

Current behavior

• crates/authmap-config/src/lib.rs supports custom authorization rules, sensitivity labels (sensitivity.routes/resources), scan limits, and drift fail_on categories — but nothing route-scoped for suppression or reclassification.
• Adapters are auto-enabled via project hints with no opt-out.

Proposed implementation

1. Per-route suppressions (audit-trail preserving)

   [[suppressions]]
   route = "GET /internal/healthz"     # "METHOD /path" with trailing-* glob on path
   framework = "express"                # optional narrowing
   class = "unauthenticated"            # optional: suppress only this coverage class
   reason = "Health probe; network-isolated"  # REQUIRED
   expires = "2026-12-31"               # optional: stale suppressions emit a diagnostic

   • Suppressed findings are not deleted: they remain in JSON with suppressed: true + reason (consumers per docs/JSON_CONSUMERS.md can filter), are excluded from Markdown summary counts and exit-code/drift gating, and flow into SARIF suppressions[] (see companion SARIF issue).
   • reason is mandatory — reject config without it. Expired suppressions produce a config.suppression_expired diagnostic.
2. Coverage-class overrides

   [[overrides]]
   route = "POST /webhooks/stripe"
   class = "public_declared"
   reason = "Signature-verified webhook; auth is cryptographic, not session"

   • Applied after classification; the original computed class is preserved in the route's metadata/rationale so drift detection still sees underlying changes (an override on a route whose computed class shifts should surface in authmap diff, not mask it).
3. Adapter toggles
   • adapters.disable = ["fastapi"] (and adapters.enable allow-list form) checked at the framework-gating stage; disabled adapters emit a one-line informational diagnostic so reports are self-explaining.

Acceptance criteria

• Suppressed finding: absent from Markdown counts and gating, present in JSON with suppressed: true and reason; glob + method matching covered by unit tests.
• Missing reason fails config validation with a clear error; expired suppression emits the diagnostic.
• Override changes the reported class, retains the computed class in metadata, and drift diff still detects underlying classification movement.
• Disabled adapter contributes no routes and emits the informational diagnostic.
• JSON schema (schemas/), docs/CONFIGURATION.md, docs/JSON_CONSUMERS.md, docs/DIAGNOSTICS.md updated; golden fixtures; CHANGELOG entry.

References

• crates/authmap-config/src/lib.rs (config schema)
• docs/CONFIGURATION.md, docs/JSON_CONSUMERS.md
• Companion: SARIF suppressions issue (relatedLocations/suppressions)