docs(server): design the SubjectService token principal (RIG-2863)

docs/designs/DECISIONS.md

@@ -58,6 +58,7 @@ check enforces the mechanical half. Full rationale:
 | DL-011 | The Server tier is built by promoting `compass-daemon` in place, not a new server crate | Active (Matt, 2026-07-08) | [architecture lineage](meta/compass-architecture-lineage/design.md) |
 | DL-012 | The authenticated network door is rustls-via-tonic TLS + bearer-token accounts (in-memory token store for T2) | Active (Matt, 2026-07-08) | [architecture lineage](meta/compass-architecture-lineage/design.md) |
 | DL-312 | Servers are stateless L7-load-balanced instances (any Server handles any client request); Runners are individually subject-addressable over a message-bus fabric (one FABRIC connection per party — plus the reduced Connect authn/RPC edge per DL-316), never single-Server-owns-Runners and never an N×M direct-stream mesh; delivery to a live client routes over a per-connection subject to the one Server holding the socket; session→Runner routing truth stays durable in Postgres (`agent_placements` + session bindings), and the Runner remains a pure forwarder with Server-side fail-closed account resolution | Active (Matt, 2026-08-31) | [multi-tenancy & NATS substrate](infra/runtime/compass-managed-multitenancy/design.md#q2--serverrunner-connection-topology-load-balanced-servers-subject-addressable-runners) |
+| DL-327 | The token-subject model admits a THIRD principal class, `SubjectService SubjectKind = 2` — ONE class for every first-party supervised compute tier authenticating back to the Server (LLM gateway now, MCP gateway later), never a kind per tier: tiers present distinct Subject IDs (`llm-gateway`, `mcp-gateway`) isolated by per-surface authz (the account-door `owner_user_id` precedent), and the shared `ResolveToken` `want != Kind` gate auto-rejects cross-door presentation. `tokens.subject_kind` CHECK extends `IN (0, 1)` → `IN (0, 1, 2)` in `0001_init.sql` in place (safe only before any non-disposable database has applied v1: `migrate()` is version-keyed, so an already-migrated DB keeps the old CHECK — pre-GA disposable-env posture, else a new ALTER migration). Named `SubjectService`, not `SubjectStack`/`SubjectGateway`. Amends the retired v0.6 record's two-kind seal | Active (Matt, 2026-09-04) | [service subject principal](server/compass-service-subject-principal.md) |
 
 ## Transport