AMR-based permission checking should use tokens for reduced computation

At the time of login (or first attempt at accessing some endpoint) the user should be granted a token that represented access to every artefact that they can edit through some AMR, so that we avoid repeated querying in the same user session

No files, tests, or entry points are named. Start by locating the login and endpoint permission-checking paths, then clarify what an AMR is and the token's required scope and lifetime; done should mean an agreed implementation plan for avoiding repeated permission queries within a user session.

Written by the indexing model from the issue text.