feat(auth): surface manifest has_auth/public_key and ensure shared auth running

Parse has_auth/public_key from the service manifest onto Container
(persisted to InstalledMetadata), fetch manifests for running non-db
containers during reconciliation, hide role=auth containers from the
grid, and ensure dcntrlized-auth starts with the shared database.

spec.yaml

@@ -123,6 +123,18 @@ components:
             type: string
             example: "database"
           description: Capabilities declared by the service manifest (e.g. database).
+        has_auth:
+          type: boolean
+          description: >-
+            Whether the service consumes the shared auth service (manifest
+            has_auth). True for dcntrlized-auth itself and for auth-consuming
+            services.
+        public_key:
+          type: string
+          description: >-
+            The auth service's RS256 public key (manifest public_key); the hook
+            for a future Maestro dashboard auth that validates dcntrlized-auth
+            tokens.
         docker_name:
           type: string
         image: