[Story]: Audit and close uncalled permission-check gaps (closes #177)

## Summary
Audit every existing and new RBAC/permission check in lightbridge-authz to confirm it is actually invoked on the live request path, directly closing the pattern behind lightbridge-authz#177 (a governance ceiling defined but never called).

## Intent / Source of truth
#177 demonstrated that a permission boundary can exist in code, look correct in review, and still be unenforced because the validation function was never wired into the request path. This story is the systemic fix, not just a point patch. Part of [Epic] RBAC beyond admin and user.

## Scope
- [ ] Static/dynamic audit of every permission-check function: confirm each has at least one caller on a real request path
- [ ] Add a coverage test asserting every declared role/permission boundary has an integration test that fails if the check is removed (mutation-testing style)
- [ ] Fix lightbridge-authz#177 itself as part of this story
- [ ] Add a lint/CI check preventing a merged, uncalled validation function from recurring

## Out of scope
- Broader static-analysis tooling unrelated to authorization checks

## Verification
Every permission-check function in the codebase has a passing "removing this call breaks a test" verification; #177 closed with a regression test; CI gate added.

## Risk assessment
This is explicitly a governance/trust-repair story — the fix must be demonstrably systemic (a CI gate), not just a one-off patch, or the same class of bug recurs with the next role added.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Start with lightbridge-authz#177, then inventory every permission-check function and trace whether it is called on a live request path. Review the integration-test and CI areas relevant to authorization checks. Done means every check has removal-sensitive verification, #177 has a regression test, and a CI gate prevents uncalled validation functions.

由索引模型根据 Issue 内容生成。