Create Page dropdown lists all page content types regardless of user permissions

Problem Statement

When a user role is configured with permissions on only specific page content types, the Create Page dropdown in the Pages Tool still lists all page content types in the instance — including those the role has no permission on.

Root Cause (identified):
PageResource.getPageTypes() at PageResource.java:L1505 calls contentTypeAPI.findByBaseType(HTMLPAGE, ...) and findUrlMapped() and returns results directly — no PermissionAPI.filterCollection(..., CAN_ADD_CHILDREN, user) is applied.

Steps to Reproduce

https://drive.google.com/file/d/1ToDBRFL-mS5GGBLnQW1gprfqzDlFAAov/view?usp=drive_link

Steps to Reproduce:

Configure a role with permissions on only specific page content types (e.g. GC Page, GC Events, GC Announcements)
Log in as a user with that role
Go to Pages Tool → click Create Page
Observe the dropdown lists all page content types, not just the permitted ones

Acceptance Criteria

Expected Behavior

The Create Page dropdown should only list the page content types that the user's role has permissions on — in this case: GC Page, GC Events, GC Announcements.

Actual Behavior

The Create Page dropdown lists all ~8 page content types in the instance, including those the role has no permissions on. Clicking a non-permitted type does correctly block creation, but the listing itself is unfiltered — causing confusion for end users.

dotCMS Version

26.04.11-02

Severity

Medium - Some functionality impacted

Links

https://dotcms.freshdesk.com/a/tickets/36434

Start in dotCMS/src/main/java/com/dotcms/rest/api/v1/page/PageResource.java at getPageTypes(), then inspect how PermissionAPI.filterCollection(..., CAN_ADD_CHILDREN, user) is used elsewhere. Reproduce with a role permitted for only selected page content types and verify the Create Page dropdown excludes the others while permitted types remain available.