Have specific security roles

Currently most tool usage requires the user to just be authenticated.
Add fine grained authorization for being able to search, index, create collections and view stats.

The issue identifies search, indexing, collection creation, and stats as the affected tool operations, but names no files or tests. Start by locating those operation handlers and the existing authentication configuration; define the permission boundaries and verify each operation's unauthorized behavior.

Written by the indexing model from the issue text.