Feature/openfga integration - #1

Adds OpenFGA as a supported policy store backend (originally contributed
via permitio#673 from daveads/opal), with fixes to make it actually
work end-to-end:

- New OPENFGA policy store: OpenFGAClient (opal-client) syncs policy and
  data updates to an OpenFGA server, following the same pattern as the
  existing OPA/Cedar backends.
- Inline OpenFGA support: the client-openfga Docker image runs an embedded
  OpenFGA server via scripts/start-openfga.sh, which starts OpenFGA, waits
  for it to be healthy, and auto-creates a store when
  OPAL_OPENFGA_STORE_ID isn't set (replacing a broken supervisord-based
  CMD override that never actually started the opal-client process, and a
  hardcoded store id that only existed in the original author's own
  OpenFGA instance).
- App tests: app-tests/openfga-test.py exercises permission checks,
  relationship reads, and authorization-model validation against a live
  OpenFGA instance. app-tests/run-openfga-services.sh now builds both the
  client-openfga and server images from source (permitio/opal-client-openfga
  isn't published anywhere, and opal-server needs this branch's changes -
  pulling the published image would silently run unpatched upstream code),
  waits for opal-client's /ready endpoint instead of a fixed sleep, and
  discovers the auto-created store id at runtime instead of assuming a
  fixed one.
- opal_server's default all-data route now searches the policy repo clone
  for a data file (data.json by default) instead of always returning {},
  with a short bounded retry to cover the repo clone still being in
  progress on first request.
- OpenFGAClient.set_policy_data treats an empty {} data payload as zero
  tuples (a valid state) instead of raising - relevant when no data source
  is configured, or briefly during the clone race above.
- Fixed openfga-app-test.yml's trigger (branches: [test] -> [master]) so
  it actually runs in CI.
- Restored a dropped `import functools` and implemented the abstract
  OpenFGARunner.health_check(), both required by changes to master that
  landed after PR permitio#673 was opened.