feat: enforce RBAC and harden collaboration features (#1327)

* feat: enforce RBAC and harden collaboration features

- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing

* fix: enforce RBAC across split routes

src/backend/database/routes/host-command-history-routes.ts

@@ -7,6 +7,8 @@ import { isNonEmptyString } from "./host-normalizers.js";
 export function registerHostCommandHistoryRoutes(
   router: Router,
   authenticateJWT: RequestHandler,
+  requireViewPermission: RequestHandler,
+  requireDataAccess: RequestHandler,
 ): void {
   /**
    * @openapi
@@ -33,6 +35,8 @@ export function registerHostCommandHistoryRoutes(
   router.get(
     "/command-history/:hostId",
     authenticateJWT,
+    requireViewPermission,
+    requireDataAccess,
     async (req: Request, res: Response) => {
       const userId = (req as AuthenticatedRequest).userId;
       const hostIdParam = Array.isArray(req.params.hostId)
@@ -98,6 +102,8 @@ export function registerHostCommandHistoryRoutes(
   router.delete(
     "/command-history",
     authenticateJWT,
+    requireViewPermission,
+    requireDataAccess,
     async (req: Request, res: Response) => {
       const userId = (req as AuthenticatedRequest).userId;
       const { hostId, command } = req.body;