feat: implement delegatable capability tokens with cascading revocation.

Description

The pitch.

### Description
This PR addresses all outstanding auditor and committee feedback for Problem 04 (Delegatable Capability Tokens with Cascading Revocation). 

To ensure complete backward-compatibility and avoid colliding with other merged PRs, our implementation is namespaced under the plugin name `delegatable_cascading`.

### Key Achievements
- **Cascading Revocation**: Implemented path-based validation that walks the ancestor chain via JTI mapping. If any parent token in the delegation chain is revoked, all downstream sub-delegations are automatically invalidated.
- **Audience Protection**: Integrated a `presenter` check into the `verify` method signature of `Auth`, `JwtAuth`, and `DelegatableAuth`. The presenter check is enforced inside the plugin to prevent audience-confusion attacks.
- **Robust testing**:
  - Implemented unit tests validating scope attenuation, expiration, and presenter boundaries.
  - Added a `hypothesis` property-based test checking transitive revocation over random delegation lengths and revocation indices.
  - Wrote scenario tests comparing flat `jwt` baseline (where attacks succeed) against `delegatable_cascading` (where all attacks are blocked) using the official validators.

### Auditor Feedback Remediated
- **Plugin-level Audience Protection**: Moved audience-confusion check from the scenario runner into the plugin by passing the `presenter` parameter to the `verify` protocol.
- **Cleaned Up Workspace Leftovers**: Removed all containerization, `railway.json`, and the `apps/nanda-sandbox/` directory from this Phase 1 PR's commit history (keeping them isolated to Phase 2). Removed duplicate `my_privacy_layer.py` and `test_privacy.py`.
- **Branch Renaming**: Renamed branch to `hackathon/tanishaacodes-delegatable-auth`.
- **JWT baseline & Revocation**: Corrected revocation logic to store the last block's `jti` to ensure correct cascading verification.

### Verification & CI Status
All local CI checks pass cleanly:
- **Pytest**: `1162 passed` (fully green including all reference plugins and core scenarios).
- **Pyright**: `0 errors` (strict type checks pass cleanly).
- **Ruff**: Clean.