[RBAC PR 2] Add admin break-glass bypass to RBAC authorization

[philipfweiss]

Tracking: #2234 (step 2 of the RBAC enablement sequence).

The RBAC proposal's first resolution step is "if the user is an admin, allow immediately." That short-circuit didn't exist: is_admin was on the user model but never consulted in the authorization path, so there was no break-glass and a deny-by-default flip would lock out admins too.

This adds it:

• Threads is_admin into AuthContext (from user.is_admin).
• RBACAuthorizationService.authorize short-circuits for admins, approving all requests with reason="admin".
• The bypass is a single explicit check and is logged for audit (username, id, and the requests granted), which also pre-pays for the audit-logging work later.

Below I verified the admin break galss:

---

Verification:

1. Started local DJ server

./dev.sh up -d
DJ  : http://localhost:8000
UI  : http://localhost:3000
GET /health/
attempt=1 status=200 body=[{"name":"database","status":"ok"}]

2. Enabled RBAC restrictive setting

authorization_provider= rbac
default_access_policy= restrictive

3. Logged in as non-admin user. Then, verified that they're denied.

curl -sS -c /tmp/dj-pr2232.cookies \
  -X POST "http://localhost:8000/basic/login/" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "username=dj&password=dj"
curl -sS -b /tmp/dj-pr2232.cookies "http://localhost:8000/whoami/"

curl -sS -b /tmp/dj-pr2232.cookies \
  -X POST "http://localhost:8000/nodes/source/" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "manual_admin_bypass.orders_non_admin",
    "catalog": "default",
    "schema": "public",
    "table": "orders_non_admin",
    "columns": [
      {"name": "id", "type": "int"}
    ]
  }'

4. Marked same user as admin

docker exec dj-s0-postgres psql -U dj -d dj \
  -c "update users set is_admin = true where username = 'dj';"

GET /whoami/ -> {"username":"dj","is_admin":true} HTTP_STATUS:200

5. Verified bypass works

curl -sS -b /tmp/dj-pr2232.cookies \
  -X POST "http://localhost:8000/nodes/source/" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "manual_admin_bypass.orders_admin",
    "catalog": "default",
    "schema": "public",
    "table": "orders_admin",
    "columns": [
      {"name": "id", "type": "int"}
    ]
  }'

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	d0d0bc7
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a4597639cc9810008994d56