Reference a provider for forward-auth

Parent

A tier's forward-auth names the provider that answers it, not a URL, so the address follows the provider. Carried as a rewrite input by Decide the fate of the open work that predates the map.

Forward-auth is a reference to a declared provider, and an unknown reference is refused.
The rendered middleware's address is derived from the provider's Stable Address.
No URL is authored for it.
The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
Each refusal has a refusal example with its diagnostics file.
The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
The behaviour-ledger row lands with its test, and npm run verify passes.

feat(model): a tier's forward-auth names its provider, not a URL