feat(auth): centralize ThothII permission enforcement

backend/src/auth/config.ts

@@ -22,7 +22,7 @@ export type {
 
 const MAX_AUTH_CONFIG_BYTES = 1024 * 1024;
 const ROLES = ["user", "admin"] as const;
-const PERMISSIONS: readonly Permission[] = [
+export const PERMISSION_CATALOG: readonly Permission[] = [
   "session.use", "session.read_all", "session.manage_all", "settings.manage",
   "workspace.manage", "workspace.secrets.manage", "pi.manage", "auth.diagnostics.read",
 ];
@@ -189,6 +189,10 @@ export function rolesToPermissions(roles: readonly Role[]): readonly Permission[
     if (!ROLES.includes(role)) throw invalid();
     requested.add(role);
   }
-  if (requested.has("admin")) return PERMISSIONS;
+  if (requested.has("admin")) return PERMISSION_CATALOG;
   return requested.has("user") ? ["session.use"] : [];
 }
+
+export function isPermission(value: string): value is Permission {
+  return PERMISSION_CATALOG.includes(value as Permission);
+}