feat(auth): centralize ThothII permission enforcement

backend/test/auth.test.ts

@@ -29,6 +29,8 @@ test("server smoke trusted claims transform through nginx to a non-admin princip
     issuer: "task13-proxy",
     subject: "task13-user",
     displayName: "Task 13 User",
+    roles: ["user"],
+    permissions: ["session.use"],
     isAdmin: false,
   });
 });
@@ -40,7 +42,12 @@ test("local mode resolves a stable local principal", async () => {
   expect((await app.inject({ method: "GET", url: "/me" })).json()).toMatchObject({
     issuer: "local",
     subject: expect.any(String),
-    isAdmin: false,
+    roles: ["admin"],
+    permissions: [
+      "session.use", "session.read_all", "session.manage_all", "settings.manage",
+      "workspace.manage", "workspace.secrets.manage", "pi.manage", "auth.diagnostics.read",
+    ],
+    isAdmin: true,
   });
 });
 
@@ -53,7 +60,10 @@ test("mock mode makes a principal from the test header", async () => {
     url: "/me",
     headers: { "x-mock-user": "alice" },
   });
-  expect(res.json()).toEqual({ issuer: "mock", subject: "alice", displayName: "alice", isAdmin: false });
+  expect(res.json()).toEqual({
+    issuer: "mock", subject: "alice", displayName: "alice",
+    roles: ["user"], permissions: ["session.use"], isAdmin: false,
+  });
 });
 
 test("upstream mode accepts only normalized proxy principal headers", async () => {
@@ -74,7 +84,12 @@ test("upstream mode accepts only normalized proxy principal headers", async () =
     },
   });
   expect(authenticated.json()).toEqual({
-    issuer: "portal", subject: "42", displayName: "Alice", isAdmin: true,
+    issuer: "portal", subject: "42", displayName: "Alice", roles: ["user", "admin"],
+    permissions: [
+      "session.use", "session.read_all", "session.manage_all", "settings.manage",
+      "workspace.manage", "workspace.secrets.manage", "pi.manage", "auth.diagnostics.read",
+    ],
+    isAdmin: true,
   });
 });