feat(auth): centralize ThothII permission enforcement

backend/src/routes/meta.ts

@@ -2,6 +2,7 @@ import { readdirSync } from "node:fs";
 import { join } from "node:path";
 import type { FastifyInstance } from "fastify";
 import type { PiModel } from "../pi/list-models.js";
+import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
 
 export type ListModelsFn = () => Promise<PiModel[]>;
 
@@ -26,7 +27,8 @@ export function metaRoutes(
   app: FastifyInstance,
   deps: { harnessDir: string; listModels?: ListModelsFn },
 ): void {
-  app.get("/models", async () => {
+  app.get("/models", async (request, reply) => {
+    if (!isPrincipalContext(requirePermission(request, reply, "session.use"))) return reply;
     const fn = deps.listModels ?? (async () => []);
     try {
       return { models: await fn() };