feat(rbac): implement GET /Permissions capability contract

[KinshukSS2]

Problem

The backend currently lacks a production GET /Permissions endpoint, so the frontend cannot reliably render role-aware behavior from backend truth.

Goal

Add authenticated GET /Permissions with a stable capability schema aligned with RBAC proposal requirements.

Scope

• Add endpoint and router wiring
• Return stable permission schema
• Derive non-admin permissions from backend policy truth (policy-based capability contract)
• Add tests

Technical Requirements

• Enforce contract with a formal Pydantic response_model (extra=forbid)
• Map policy command ALL to full CRUD (read/create/update/delete = true)
• Return 401 for invalid/malformed/missing authenticated user identity
• Include role membership in policy lookup (username + role + public)

Acceptance Criteria

• GET /Permissions implemented and secured
• Stable payload schema and keys
• Schema contract enforced via strict Pydantic response model
• Admin override behavior
• Non-admin backend-derived capabilities
• ALL policy command maps to full CRUD booleans
• Auth failure returns 401
• Tests for admin/non-admin/auth-failure

Proposal Alignment

This directly implements the proposal requirement for a stable GET /Permissions capability contract used by role-aware frontend rendering.