* feat: add Horizon authentication client and state * fix: apply Windows state ACLs to existing descriptors * fix: distinguish public route authorization failures * fix: harden Horizon state boundaries
