[AZ-487] [AZ-488] chore: cycle 2 Step 15 skip + record JWT-attach script rot

Step 15 (Performance Test) — skipped per gate (option B). Recording two
deferred items in the existing perf leftover:

* PT-07 + PT-08 remain Deferred. Both NFRs depend on the same
  baseline-capture harness that has not landed; the integration-test
  fixtures needed for PT-08 already exist (UavUploadTests +
  UavTileImageFactory), so PT-08 attaches to the same harness as PT-07
  when implemented.
* scripts/run-performance-tests.sh PT-01..PT-06 currently return 401
  against the post-AZ-487 build because they attach no Bearer token.
  Script must mint an HS256 token from JWT_SECRET at script start
  before any curl call. Tracked in the leftover so PT-01..PT-06 are
  runnable again the same cycle PT-07/PT-08 are activated.

No code change in this commit — leftover + state advance only.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_autodev_state.md

@@ -2,8 +2,8 @@
 
 ## Current Step
 flow: existing-code
-step: 15
-name: Performance Test
+step: 16
+name: Deploy
 status: not_started
 sub_step:
   phase: 0