RBAC: Enforce mandatory resource authorization and allowed actions

Parent

• #806

What to build

Replace alternative-grant resource authorization with a mandatory constraint phase and prove it through representative workflow definition and execution resources. A granted role permission remains necessary but cannot override an account, membership, scope, or resource veto. Authorized collection queries enforce visibility before materialization, and Server returns allowed actions for Studio after loading the resource.

Studio renders resource-sensitive actions from the Server result rather than recreating policy.

Covers PRD user stories 39-46, 49-51, 56, 64, and 95-98.

Acceptance criteria

• Mandatory authorization constraints use a contract whose denial cannot be converted to success by a general permission or another handler.
• Representative workflow definition and execution operations require both effective permission and every applicable account, membership, scope, and resource constraint.
• Resource-sensitive reads and mutations return established 401, 403, or non-disclosing 404 behavior without leaking foreign-tenant existence.
• Collection visibility is applied in the persistence query rather than through post-fetch in-memory filtering.
• Continuation cursors are bound to exact authorization scope and permission revision and are rejected after incompatible authorization changes.
• Server returns allowed resource actions or a disclosure-safe explanation after resource loading.
• Studio consumes allowed actions, disables useful forbidden actions with a reason, and never infers resource authority from tenant-wide permissions alone.
• Server HTTP/query/security tests and Studio integration tests prove mandatory vetoes, query isolation, cursor binding, allowed actions, and non-disclosing failures.

Blocked by

• #830

Start by resolving the blocked dependency #830, then map the Server authorization and persistence-query paths for workflow definition and execution resources. Run the Server HTTP/query/security tests and Studio integration tests; done requires mandatory vetoes, scope-bound cursors, isolated collections, disclosure-safe failures, and Server-provided actions consumed by Studio.