Scoped PATs: permission enforcement

[cstns]

Description

Adds PAT scope enforcement to the permission layer, building on the metadata populated in #7446 and the CRUD routes from #7515.

• When adminOptIn is false, the admin flag is shadowed on the session user via Object.defineProperty so all downstream checks treat the request as non-admin without mutating the Sequelize model.
• needsPermission enforces team scope and read-only after the existing role checks. The admin bypass path also enforces these restrictions when the PAT has adminOptIn: true.
• hasPermission applies the same checks via @fastify/request-context, naturally skipped for non-HTTP paths like MQTT ACL.
• No changes to shared preHandlers or data loading. Enforcement lives in the permission layer only.

The issue proposed nullifying request.teamMembership in the shared preHandlers when a PAT's team scopes don't include the current team. I tried this but reverted it because nullifying membership conflates "user isn't a member" with "PAT restricts access", which are different concerns. Enforcement belongs in the permission layer where it can deny access without altering the request data that downstream code relies on.

No functional changes for existing tokens

Existing PATs default to readOnly: false, adminOptIn: false, no team scopes. The only behavioral change is that admin users authenticating with a default PAT no longer get the admin bypass (since adminOptIn defaults to false).

Related Issue(s)

closes #7447

Checklist

• I have read the contribution guidelines
• Suitable unit/system level tests have been added and they pass
• Documentation has been updated
  • Upgrade instructions
  • Configuration details
  • Concepts
• Changes flowforge.yml?
  • Issue/PR raised on FlowFuse/helm to update ConfigMap Template
  • Issue/PR raised on FlowFuse/CloudProject to update values for Staging/Production
• Link to Changelog Entry PR, or note why one is not needed.

Labels

• Includes a DB migration? -> add the area:migration label

[codecov]

Codecov Report

❌ Patch coverage is 82.22222% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.08%. Comparing base (a5e2f37) to head (8309ea5).

Files with missing lines	Patch %	Lines
forge/routes/auth/permissions.js	76.47%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7777      +/-   ##
==========================================
+ Coverage   75.04%   75.08%   +0.04%     
==========================================
  Files         430      430              
  Lines       22781    22825      +44     
  Branches     6036     6052      +16     
==========================================
+ Hits        17095    17138      +43     
- Misses       5686     5687       +1     

Flag	Coverage Δ
backend	75.08% <82.22%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[knolleary]

@cstns having merged #7766 we now have merge conflicts on this one

[knolleary]

Will be approved pending the merge conflict resolution

[cstns]

Curious case of merge conflict, this branch only built upon the previous one. Fixed nonetheless