feat(auth): centralize ThothII permission enforcement

backend/test/pi-process-manager.test.ts

@@ -124,8 +124,8 @@ test("teardownForPrincipal stops only runtimes owned by that user", () => {
   bobChild.kill = vi.fn();
   const children = [aliceChild, bobChild];
   const mgr = new PiProcessManager(loadConfig({}), { spawnFn: () => children.shift() as any });
-  const alice = { issuer: "portal", subject: "alice", isAdmin: false };
-  const bob = { issuer: "portal", subject: "bob", isAdmin: false };
+  const alice = { issuer: "portal", subject: "alice", roles: ["user"] as const, permissions: ["session.use"] as const, isAdmin: false };
+  const bob = { issuer: "portal", subject: "bob", roles: ["user"] as const, permissions: ["session.use"] as const, isAdmin: false };
   mgr.createFor("alice-session", { principal: alice });
   mgr.createFor("bob-session", { principal: bob });
 
@@ -145,7 +145,7 @@ test("createFor keeps at most one runtime for the same user", () => {
   secondChild.kill = vi.fn();
   const children = [firstChild, secondChild];
   const mgr = new PiProcessManager(loadConfig({}), { spawnFn: () => children.shift() as any });
-  const principal = { issuer: "portal", subject: "alice", isAdmin: false };
+  const principal = { issuer: "portal", subject: "alice", roles: ["user"] as const, permissions: ["session.use"] as const, isAdmin: false };
 
   mgr.createFor("first", { principal });
   const second = mgr.createFor("second", { principal });