Function resolveAuthorizedChatCardHandler

Resolve the handler document for a chat-card click and authorize it — the current client is only allowed to act if it owns that document (a GM owns all). Returns the document when authorized, or null when the click must be ignored (no handler uuid, the uuid does not resolve, or the client is not an owner).

Chat cards address their buttons to the actor that should handle the click (via resolveChatCardHandlerUuid's attributes — most explicitly data-handler-actor-uuid). An action run from a card mutates that actor's own state, so — under actor-state sovereignty — only a client that owns the actor may run it. This is the click-time half of that rule; the render-time half (gateAutomatedDefenseButtons) hides buttons the client can't use. The render-time gate is UX only and is bypassable by a synthesized click or a direct handler call, so this authorization gate is the real boundary before any dialog, scope revival, or intrinsic logic runs (issue #167).

Pure: Foundry document resolution is injected via resolveDoc (the caller passes foundry.utils.fromUuidSync), so this stays Foundry-free and unit-testable, mirroring gateAutomatedDefenseButtons.

The SELF_HANDLER sentinel (@self) is resolved via resolveSelf instead — the clicking user's own default character — supporting open sequence buttons that anyone may answer.