feat: Add pre-filter authorization via LookupResources + remove fail_open

[sohanmaheshwar]

Summary

• New: `SpiceDBPreFilterRetriever` — LangChain `BaseRetriever` that calls SpiceDB's `LookupResources` first, then runs a filtered vector store search. Use when users have access to a small fraction of a large corpus.
• New: `create_lookup_resources_node` — LangGraph node that combines LookupResources + filtered vector search in one step. Reads `subject_id` + `question` from state, writes `authorized_documents`.
• New: `SpiceDBAuthorizer.lookup_resources()` — underlying method wrapping SpiceDB's `LookupResources` gRPC streaming API.
• Breaking: `create_auth_node` renamed to `create_check_permissions_node` — aligns with SpiceDB API naming.
• Breaking: `fail_open` removed from all components — errors now always propagate.
• Breaking: `SpiceDBRetriever` removed — superseded by `SpiceDBAuthFilter`.
• Breaking: `SpiceDBAuthLambda` removed — superseded by `SpiceDBAuthFilter`.

Breaking Changes

This release bumps to v0.2.0. See CHANGELOG.md for full details.

Symbol	Change	Migration
`SpiceDBRetriever`	Removed	Use `base_retriever | SpiceDBAuthFilter` and pass `subject_id` via `config={"configurable": {"subject_id": "alice"}}`
`SpiceDBAuthLambda`	Removed	Use `SpiceDBAuthFilter` directly: `RunnableLambda(retriever) | auth_filter`
`create_auth_node`	Renamed to `create_check_permissions_node`	Update imports and call sites
`fail_open` parameter	Removed	Remove the argument — errors now surface instead of silently granting access

Component Lineup After This PR

Component	Pattern	Interface
`SpiceDBAuthFilter`	Post-filter	`Runnable` (pipe operator)
`SpiceDBPreFilterRetriever`	Pre-filter	`BaseRetriever`
`SpiceDBPermissionTool` / `SpiceDBBulkPermissionTool`	Check	LangChain Tool
`create_check_permissions_node`	Post-filter	LangGraph node
`create_lookup_resources_node`	Pre-filter	LangGraph node

Test Plan

• 41/41 unit tests pass (`pytest tests/unit_tests/`)
• Manually test `SpiceDBPreFilterRetriever` with a live SpiceDB instance
• Manually test `create_lookup_resources_node` in a LangGraph workflow
• Verify SpiceDB errors raise instead of silently passing (fail_open removed)