feat(guard): add ability aliases, wildcard abilities, and conditional abilities

[techmahedy]

Three new authorization features that compose cleanly with all existing Guard functionality (before/after hooks, hierarchy, policies, any(), all()).

Ability Aliases — map alternative names to existing abilities, useful for shorthands and backwards compatibility after renames.

Guard::define('update-post', fn(User $user, Post $post) => $user->id === $post->user_id);
Guard::alias('edit', 'update-post');

Guard::allows('edit', $post); // resolves to 'update-post' internally

Wildcard Abilities — cover a family of related ability names with a single rule using * as a dot-segment placeholder.

Guard::wildcard('post.*', fn(User $user) => $user->role === 'editor');

Guard::allows('post.create'); // matched by 'post.*'
Guard::allows('post.delete'); // matched by 'post.*'
Guard::allows('post.publish'); // matched by 'post.*'

Conditional Abilities — attach a runtime gate to any ability that denies access when application-level state (feature flags, time windows, environment) is not met, regardless of what the ability callback would return.

Guard::condition('beta-dashboard', fn() => config('features.beta'));
Guard::define('beta-dashboard', fn(User $user) => $user->plan === 'pro');

Guard::allows('beta-dashboard'); // false when feature flag is off, even for pro users

New methods: alias(), aliases(), resolveAlias(), wildcard(), matchWildcard(), condition(), conditions()

Tests: 52 new assertions covering all three features individually and in combination.