feat(perm): requirePermission + requireBotAccess middleware

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/middleware/requirePermission.ts

@@ -0,0 +1,19 @@
+import type { Request, Response, NextFunction, RequestHandler } from "express";
+
+export function requirePermission(capability: string): RequestHandler {
+  return (req: Request, res: Response, next: NextFunction) => {
+    if (!req.user) { res.status(401).json({ error: "unauthenticated" }); return; }
+    if (req.user.role === "admin" || req.user.capabilities?.has(capability)) { next(); return; }
+    res.status(403).json({ error: "forbidden" });
+  };
+}
+
+export function requireBotAccess(paramName = "botId"): RequestHandler {
+  return (req: Request, res: Response, next: NextFunction) => {
+    if (!req.user) { res.status(401).json({ error: "unauthenticated" }); return; }
+    if (req.user.role === "admin" || req.user.bots === "all") { next(); return; }
+    const botId = req.params[paramName];
+    if (typeof botId === "string" && req.user.bots instanceof Set && req.user.bots.has(botId)) { next(); return; }
+    res.status(403).json({ error: "forbidden" });
+  };
+}