A background job still needs a subject

Cron and queue workers often skip authorization because "there is no user." That creates a god-mode path. Give the job a service identity with the narrowest permissions it needs, and still check those