feat(auth): implement group-role mapping and permission system

Architecture changes:
- Permission format: domain.category:action (e.g., control-room.general:admin)
- Decoupled groups from roles via group_roles mapping table
- Groups are organizational (synced from Authentik)
- Roles are permissions (admin-managed via API)

New features:
- require_permission() and require_any_permission() dependency factories
- Action hierarchy: admin > editor > user > viewer
- Global admin override (admin.general:admin grants all)
- Group-role management endpoints (assign/remove roles)
- GET /auth/roles endpoint to list all roles

Database changes:
- Added category column to roles table (default: general)
- Removed authentik_group column (decoupled)
- Added group_roles association table
- Added user_groups association table
- Migration updates role names to domain.general:action format

Tests:
- 67 new tests for auth service and controller
- Covers token validation, user sync, role sync
- Covers group-role assignment/removal
- Covers schema conversions and permission system

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/domains/auth/__init__.py

@@ -11,6 +11,12 @@ from src.domains.auth.oidc import (
     get_forward_auth_user,
     get_forward_auth_admin,
     oidc_config,
+    # Permission system
+    require_permission,
+    require_any_permission,
+    ACTION_HIERARCHY,
+    VALID_DOMAINS,
+    DEFAULT_CATEGORY,
 )
 from src.domains.auth.service import AuthService, get_auth_service
 from src.domains.auth.controller import auth_controller
@@ -22,6 +28,7 @@ from src.domains.auth.models import (
     UserPreferences,
     ApiKey,
     user_groups,
+    group_roles,
 )
 
 __all__ = [
@@ -32,6 +39,12 @@ __all__ = [
     "get_forward_auth_user",
     "get_forward_auth_admin",
     "oidc_config",
+    # Permission system
+    "require_permission",
+    "require_any_permission",
+    "ACTION_HIERARCHY",
+    "VALID_DOMAINS",
+    "DEFAULT_CATEGORY",
     # Service
     "AuthService",
     "get_auth_service",
@@ -45,4 +58,5 @@ __all__ = [
     "UserPreferences",
     "ApiKey",
     "user_groups",
+    "group_roles",
 ]