Classify configurable guard synonyms

[bjcorder]

Summary

• Add validated authorization.synonyms guard families with exact and trailing-wildcard matching that emits high-confidence canonical evidence.
• Separate built-in exact matching from low-confidence whole-token guard heuristics, preserving the matched token in evidence notes.
• Apply shared classification to Django decorators/DRF permission entries, Express, FastAPI, Next.js, and tRPC procedure roots.
• Add ready-to-paste authorization.synonyms YAML to Markdown rule suggestions and document the configuration behavior without changing the AuthMap JSON schema.

Safeguards

• Token heuristics require a guard-like name or a can-prefixed check, preventing false positives such as PermissionError and non-token substrings such as unadministered.

Verification

• cargo check --workspace --all-targets --locked
• cargo test --workspace --all-targets --locked

Closes #114