[Epic] Access-control enforcement gaps

Tracking epic for permission/authorization checks that are declared or intended but not actually enforced at some code path: REST attribute-level permissions, JWT role claims, GraphQL @allow, read-only mode, Studio access gating, and custom-operation permission declarations.

---
_Filed by Claude (Opus 4.8), issue-backlog triage & grouping pass._

No files, tests, or entry points are identified. Start by separating the REST attribute-level permissions, JWT role claims, GraphQL @allow, read-only mode, Studio access gating, and custom-operation declarations into concrete code paths; done means each intended permission is enforced consistently where it applies.

Written by the indexing model from the issue text.