fix: complete RBAC implementation lost during merge

Several RBAC features from feat/rbac-permissions were silently lost
during the merge into main. This restores and completes them:

- Add permissions and teamName to login/session API responses
- Export Permission and Role types from shared package
- Filter settings tabs by user permissions in frontend
- Extend useAuth hook with role, permissions, and hasPermission
- Restrict teams listing to admin only
- Add admin override for API keys, files, and pipelines listing
- Add ownership scoping to file access, download, and delete routes
- Register userFileRoutes in integration test server
- Mock auth import in unit permissions test to avoid SQLite lock

tests/integration/test-server.ts

@@ -29,8 +29,12 @@ import Fastify from "fastify";
 import { env } from "../../apps/api/src/config.js";
 import { db, schema } from "../../apps/api/src/db/index.js";
 import { runMigrations } from "../../apps/api/src/db/migrate.js";
-import { requirePermission } from "../../apps/api/src/permissions.js";
-import { authMiddleware, authRoutes, ensureDefaultAdmin } from "../../apps/api/src/plugins/auth.js";
+import {
+  authMiddleware,
+  authRoutes,
+  ensureDefaultAdmin,
+  requireAdmin,
+} from "../../apps/api/src/plugins/auth.js";
 import { registerUpload } from "../../apps/api/src/plugins/upload.js";
 import { apiKeyRoutes } from "../../apps/api/src/routes/api-keys.js";
 import { registerBatchRoutes } from "../../apps/api/src/routes/batch.js";
@@ -85,7 +89,7 @@ export async function buildTestApp(): Promise<TestApp> {
   // File upload/download routes
   await fileRoutes(app);
 
-  // User file library routes
+  // User file library routes (persistent file management with versioning)
   await userFileRoutes(app);
 
   // Tool routes
@@ -123,7 +127,7 @@ export async function buildTestApp(): Promise<TestApp> {
 
   // Admin health check (full diagnostics)
   app.get("/api/v1/admin/health", async (request, reply) => {
-    const admin = requirePermission("settings:read")(request, reply);
+    const admin = requireAdmin(request, reply);
     if (!admin) return;
 
     let dbOk = false;

tests/unit/api/permissions.test.ts

@@ -6,7 +6,15 @@
  */
 
 import type { Role } from "@stirling-image/shared";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+// Mock the auth plugin to avoid transitively opening a SQLite connection
+// (permissions.ts -> auth.ts -> db/index.ts), which causes lock contention
+// when running in parallel with other DB-using test files like cleanup.test.ts.
+vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
+  getAuthUser: () => null,
+}));
+
 import { getPermissions, hasPermission } from "../../../apps/api/src/permissions.js";
 
 describe("permissions", () => {