state/apiserver: derive svrRoot authorier from state.Entity