Add Binding

AddBinding links a tenant-scoped subject (a function today; future kinds tomorrow) to a service principal. Outbound c1-api calls made on the subject's behalf can then be minted as user:<service_principal_id> via an RFC 8693 token-exchange (act-as) flow. Many-aware: a subject may hold multiple bindings at the storage layer. Idempotent on (subject, service_principal_id) — adds the row if missing, resurrects it if soft-deleted, no-op if already active. Consumers that need 0-or-1 cardinality (Functions today) enforce it client-side via ListBindings + DeleteBinding. Requires the SERVICE_PRINCIPALS feature flag.