make mihomo credentials binding-aware

[luoshuijs]

Summary

• make service tickets and verifier binding-aware with explicit actor and action claims
• persist credentials and profiles by binding_id with forward migrations and repository support
• centralize action and profile enforcement through scope guards across Mihomo service surfaces

Test Plan

• go test ./...
• go test -tags=integration ./integration -v

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️