9a76a24ce6
Replace scopes JSON with a viewer/contributor/admin role column, move unsafe-method authorization from path-prefix middleware to declarative APIKey* guards on routes, and close remaining KB-scope gaps in handlers.