- Add `AuthorityGateService` verify+license gate (`opencontractserver/enrichment/services/authority_gate_service.py`) that runs after `provider.fetch()` and before `bootstrap_authority_corpus`, enforcing public-domain license, source-domain allowlist, and canonical-key/heading match verification. Non-OK verdicts are recorded as `candidate_sources` audit entries on the `AuthorityFrontier` row.
- Add `priority`, `requires_approval`, `enabled` ClassVars to `BaseAuthoritySourceProvider` for deterministic provider ordering and opt-in control.
- Relax `_provider_for` in `AuthorityDiscoveryService` to sort by `priority` and remove inline license check (gate is now the single license authority).
- Empty-sections result from a provider now records `unlocated` (via gate) rather than `failed`, giving a more precise audit trail.
