feat(auth): centralize ThothII permission enforcement

backend/test/routes-sessions.test.ts

@@ -272,6 +272,7 @@ test("session listing permits all scope only to admins", async () => {
   });
 
   expect(regularAll.statusCode).toBe(403);
+  expect(regularAll.json()).toEqual({ code: "auth_forbidden", error: "This operation is not permitted" });
   expect(mine.statusCode).toBe(200);
   expect(adminAll.statusCode).toBe(200);
   expect(seen).toEqual([false, true]);