fix: complete RBAC implementation lost during merge

Several RBAC features from feat/rbac-permissions were silently lost
during the merge into main. This restores and completes them:

- Add permissions and teamName to login/session API responses
- Export Permission and Role types from shared package
- Filter settings tabs by user permissions in frontend
- Extend useAuth hook with role, permissions, and hasPermission
- Restrict teams listing to admin only
- Add admin override for API keys, files, and pipelines listing
- Add ownership scoping to file access, download, and delete routes
- Register userFileRoutes in integration test server
- Mock auth import in unit permissions test to avoid SQLite lock

tests/unit/api/permissions.test.ts

@@ -6,7 +6,15 @@
  */
 
 import type { Role } from "@stirling-image/shared";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+// Mock the auth plugin to avoid transitively opening a SQLite connection
+// (permissions.ts -> auth.ts -> db/index.ts), which causes lock contention
+// when running in parallel with other DB-using test files like cleanup.test.ts.
+vi.mock("../../../apps/api/src/plugins/auth.js", () => ({
+  getAuthUser: () => null,
+}));
+
 import { getPermissions, hasPermission } from "../../../apps/api/src/permissions.js";
 
 describe("permissions", () => {