feat(perm): load capabilities + bot access onto req.user; expose via /me

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/server.ts

@@ -21,6 +21,7 @@ import { createAuditRouter } from "./api/audit.js";
 import { setupWebSocket } from "./websocket.js";
 import { createUserStore } from "../data/users.js";
 import { createSessionStore } from "../data/sessions.js";
+import { createPermissionStore } from "../data/permissions.js";
 import { createRequireAuth } from "./middleware/requireAuth.js";
 import { requireAdmin } from "./middleware/requireAdmin.js";
 import { csrfOriginCheck } from "./middleware/csrf.js";
@@ -73,6 +74,7 @@ export function createWebServer(options: WebServerOptions): WebServer {
   const users = createUserStore(options.database.db);
   const sessions = createSessionStore(options.database.db);
   const audit = createAuditStore(options.database.db);
+  const permissions = createPermissionStore(options.database.db);
 
   // ─── Public routes (no auth, no CSRF) ───────────────────────────────────
   app.get("/api/health", (_req, res) => {
@@ -92,10 +94,10 @@ export function createWebServer(options: WebServerOptions): WebServer {
   app.use("/api/session/login", loginLimit);
   app.use("/api/session/setup", setupLimit);
 
-  app.use("/api/session", createSessionRouter(users, sessions, audit, logger));
+  app.use("/api/session", createSessionRouter(users, sessions, audit, logger, permissions));
 
   // ─── Gates for everything else under /api ───────────────────────────────
-  const requireAuth = createRequireAuth(sessions);
+  const requireAuth = createRequireAuth(sessions, permissions);
   app.use("/api", csrfOriginCheck);
   app.use("/api", requireAuth);