Optional arm: AuthPlugin. Provided only when the caller supplies auth configuration; omitted → auth not registered. rbac is itself optional — supply jwt alone for a JWT-only application, which registers no authorization capability.