feat(auth): implement group-role mapping and permission system

Architecture changes:
- Permission format: domain.category:action (e.g., control-room.general:admin)
- Decoupled groups from roles via group_roles mapping table
- Groups are organizational (synced from Authentik)
- Roles are permissions (admin-managed via API)

New features:
- require_permission() and require_any_permission() dependency factories
- Action hierarchy: admin > editor > user > viewer
- Global admin override (admin.general:admin grants all)
- Group-role management endpoints (assign/remove roles)
- GET /auth/roles endpoint to list all roles

Database changes:
- Added category column to roles table (default: general)
- Removed authentik_group column (decoupled)
- Added group_roles association table
- Added user_groups association table
- Migration updates role names to domain.general:action format

Tests:
- 67 new tests for auth service and controller
- Covers token validation, user sync, role sync
- Covers group-role assignment/removal
- Covers schema conversions and permission system

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/domains/auth/schemas.py

@@ -26,10 +26,12 @@ class AuthSyncRequest(BaseSchema):
 
 
 class RoleSchema(BaseSchema):
-    """Role information in domain:action format"""
+    """Role information in domain.category:action format"""
 
-    name: str = Field(..., description="Role name (e.g., 'control-room:admin')")
+    id: uuid.UUID = Field(..., description="Role ID")
+    name: str = Field(..., description="Role name (e.g., 'control-room.general:admin')")
     domain: str = Field(..., description="Permission domain (e.g., 'control-room')")
+    category: str = Field(default="general", description="Permission category (e.g., 'general')")
     action: str = Field(..., description="Permission action (e.g., 'admin')")
 
 
@@ -120,6 +122,7 @@ class GroupListItemSchema(BaseSchema):
     parent_name: Optional[str] = Field(None, description="Parent group name")
     member_count: int = Field(default=0, description="Number of users in this group")
     synced_at: datetime = Field(..., description="Last sync timestamp")
+    roles: list[str] = Field(default_factory=list, description="Assigned role names")
 
 
 class GroupsListResponse(BaseSchema):
@@ -127,3 +130,18 @@ class GroupsListResponse(BaseSchema):
 
     items: list[GroupListItemSchema] = Field(..., description="List of groups")
     total: int = Field(..., description="Total count of groups")
+
+
+class RolesListResponse(BaseSchema):
+    """Response from GET /auth/roles"""
+
+    items: list[RoleSchema] = Field(..., description="List of all roles")
+    total: int = Field(..., description="Total count of roles")
+
+
+class GroupRoleAssignmentResponse(BaseSchema):
+    """Response from group role assignment operations"""
+
+    group_id: uuid.UUID = Field(..., description="Group ID")
+    group_name: str = Field(..., description="Group name")
+    roles: list[str] = Field(..., description="Currently assigned role names")