Capture a deployed function into a signed snapshot blob

Captures the deployed Wasm module bytes of the named function into a zstd-compressed, HMAC-SHA256-signed snapshot blob and returns it base64-encoded. The blob round-trips through POST /snapshot/restore.

Authorization: protected stack (bearer auth + tenant scope). The handler runs authorize_tenant against the bearer token's scope (an out-of-scope token gets 403 tenant_scope_denied before any lookup) and then a per-resource owner check against the function's tenant_id (a wildcard-scoped caller from another tenant cannot snapshot tenant A's function).

Signing uses TENSOR_WASM_API_SNAPSHOT_HMAC_KEY; when it is unset the route returns 503 snapshot_signing_not_configured rather than emitting an unsigned blob.

NOTE: this captures the function's deployed module bytes — the working save/restore-of-bytes layer with end-to-end HMAC signing. Capturing a live running instance's linear / GPU memory needs an executor capture hook that does not exist yet; requesting that capability surfaces 501 not_implemented. See crates/tensor-wasm-api/src/routes.rs.