feat: Add pre-filter authorization via LookupResources + remove fail_open

[sohanmaheshwar]

Summary

• Adds SpiceDBPreFilterRetriever — a new BaseRetriever that calls SpiceDB's LookupResources API to get authorized resource IDs before querying the vector store, then passes them through a developer-supplied filter_factory into similarity_search
• Removes fail_open from all components (SpiceDBAuthorizer, SpiceDBRetriever, SpiceDBAuthFilter, SpiceDBAuthLambda, SpiceDBAuthTool, create_auth_node, AuthorizationNode) — fail_open=True previously silently granted access to all documents on SpiceDB errors, which is a security violation
• Adds lookup_resources() to SpiceDBAuthorizer as a reusable core method

Breaking Changes

• fail_open parameter removed from all public components (v0.1.0, justified by security)
• SpiceDB errors now always propagate to the caller instead of being swallowed

Test Plan

• Run pytest tests/unit_tests/ — 43 tests, all pass
• Try SpiceDBPreFilterRetriever with your vector store of choice using a filter_factory matching its filter syntax (e.g. Pinecone: lambda ids: {"filter": {"article_id": {"$in": ids}}})
• Verify SpiceDB errors raise exceptions (not silent empty results) in existing SpiceDBRetriever usage
• Run examples/pre_filter_example.py with a live SpiceDB instance