feat(server): add project RBAC and guarded workflows

app/api/v1/endpoints/agent_auth.py

@@ -9,6 +9,7 @@ from app.auth.project_dependencies import (
     ProjectContext,
     get_project_context,
 )
+from app.auth.permissions import permissions_for_context
 
 router = APIRouter()
 
@@ -22,6 +23,7 @@ class AgentAuthContextResponse(BaseModel):
     project_id: str
     network: str
     project_role: str
+    permissions: list[str]
     token_expires_at: str | None = None
 
 
@@ -46,5 +48,6 @@ async def get_agent_auth_context(
         project_id=str(ctx.project_id),
         network=ctx.project_code,
         project_role=ctx.project_role,
+        permissions=sorted(permissions_for_context(ctx)),
         token_expires_at=token_expires_at,
     )