[RBAC PR 1] Enforce MANAGE permission on RBAC and group admin APIs

[philipfweiss]

Tracking: #2234 (step 1 of the RBAC enablement sequence).

The RBAC engine already exists, but every role/group admin endpoint was auth-only, so any logged-in user could self-grant any role. That makes restrictive access policies unenforceable.

This PR enforces the MANAGE action on those endpoints:

• Roles (api/rbac.py): create/update/delete, add/remove scope, assign/revoke now require MANAGE on the resources the scope targets. You can only grant access you already manage (prevents privilege escalation).
• Groups (api/groups.py): register and membership changes require a global MANAGE grant.
• Adds AccessChecker.add_scope() helper.

---

Why this won't take effect now: DJ’s default access policy is still permissive, so the new MANAGE checks allow requests when no explicit restrictive grant/policy denies them.

When this will start taking effect: Once a deployment enables restrictive RBAC. Since this isn't enabled today, this is a no-op. Once we seed roles, this change will become relevant.

---

Verification:

1. Started local DJ server

./dev.sh up -d
DJ  : http://localhost:8000
UI  : http://localhost:3000
GET /health/
attempt=1 status=200 body=[{"name":"database","status":"ok"}]

2. Enabled RBAC restrictive setting

authorization_provider= rbac
default_access_policy= restrictive

3. Seeded one allowed grant for the local dj user: MANAGE on finance.*. Also seeded growth roles for denied-path tests.

name                         | action | scope_type | scope_value | assigned_to
manual-finance-manager       | MANAGE | NAMESPACE  | finance.*   | dj
manual-growth-assigned-role  | READ   | NAMESPACE  | growth.*    | dj
manual-growth-role           | READ   | NAMESPACE  | growth.*    |

4. Logged in as non-admin user dj

POST /basic/login/ -> HTTP_STATUS:200
GET /whoami/ -> {"username":"dj","is_admin":false} HTTP_STATUS:200

5. Verified role creation requires MANAGE on the role scopes.

POST /roles/ finance.* role -> HTTP_STATUS:201
POST /roles/ growth.* role -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403

6. Verified adding, deleting, role metadata, assigning roles, revoking roles, deleting roles all require MANAGE

note that POST here is shorthand for the actual payload, something like

POST /roles/
{
  "name": "manual-finance-reader",
  "description": "Manual PR 2230 allowed role",
  "scopes": [
    {
      "action": "read",
      "scope_type": "namespace",
      "scope_value": "finance.*"
    }
  ]
}

POST /roles/manual-empty-role/scopes/ finance.* -> HTTP_STATUS:201
POST /roles/manual-empty-role/scopes/ growth.* -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403
...
DELETE /roles/manual-empty-role/scopes/write/namespace/finance.* -> HTTP_STATUS:204
DELETE /roles/manual-growth-role/scopes/read/namespace/growth.* -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403
...
POST /roles/manual-finance-reader/assign -> HTTP_STATUS:201
POST /roles/manual-growth-role/assign -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403
...
DELETE /roles/manual-finance-reader/assignments/dj -> HTTP_STATUS:204
DELETE /roles/manual-growth-assigned-role/assignments/dj -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403
...
DELETE /roles/manual-finance-reader -> HTTP_STATUS:204
DELETE /roles/manual-growth-role -> {"message":"Access denied to 1 resource(s): growth.*"} HTTP_STATUS:403

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	c544b6e
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a4591edafd55f00080288a6