AAuth Rich Resource Requests (draft-hardt-aauth-r3)

The vocabulary layer of AAuth, which replaces the scope string with the API description a provider already publishes. Instead of inventing calendar:write, a resource declares that its authorization vocabulary is urn:aauth:vocabulary:openapi and points at its OpenAPI — from then on the unit of authorization is an operationId, or an MCP tool name, or a gRPC method. Seven vocabularies are defined, one per interface style. It also adds per-call authorization, where a resource builds a content-addressed proposal containing the concrete parameters of one pending call and the human approves that call, once.