Enforce RequestPolicy on streaming queries

[philipgreat]

Closes #192.

What changed

• route public streaming queries through TeaQLRuntime
• require a declared purpose before public stream execution
• enforce RequestPolicy before the streaming provider is invoked
• require an authorized root trace for internal relation streams
• retain focused no-bypass tests for public and internal streaming paths

Verification

• mvn -pl teaql-runtime -am -Dtest=TeaQLRuntimeTest -Dsurefire.failIfNoSpecifiedTests=false test -q
• mvn -pl teaql-runtime -am test -q

Both commands pass.