feat: RBAC with custom permissions (beyond admin/viewer)

[kato83]

Summary

Extend the current binary role model (admin/viewer) with more granular permissions, particularly at the team level.

Motivation

Current roles are too coarse:

• admin: can do everything (ingest, manage users, manage all resources)
• viewer: can view everything but cannot ingest

Real-world needs:

• Team lead: manage their team's projects and watchlists, but not ingest or manage other teams
• Security analyst: view all vulnerabilities + manage watchlists, but not ingest
• CI/CD service account: upload SBOMs and run scans, but not manage webhooks or users

Proposed Design

Permission Model

Keep global roles (admin/viewer) but add team-level roles:

Scope	Role	Permissions
Global	admin	Everything
Global	viewer	Read-only (current)
Team	owner	Manage team resources (projects, watchlists, webhooks, members)
Team	member	View team resources, upload SBOMs, run scans

Implementation Strategy

1. Phase 1 (minimal): Keep admin/viewer global roles. Add team owner/member roles.
2. Phase 2 (future): Fine-grained permissions (if needed based on user feedback)

API Key Scoping

API keys can optionally be scoped to a team:

• Unscoped key: operates with user's full permissions
• Team-scoped key: can only access resources within that team

mayu apikey create --user-email ci@example.com --name "CI" --team platform-team

Notes

• Avoid over-engineering: start with team owner/member distinction
• Global admin always has full access (escape hatch)
• Audit log (separate issue) should record who did what with which role