feat: enforce RBAC and harden collaboration features (#1327)

* feat: enforce RBAC and harden collaboration features

- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing

* fix: enforce RBAC across split routes

src/backend/tests/utils/audit-forwarder.test.ts

@@ -3,6 +3,9 @@ import { describe, expect, it, vi, beforeEach } from "vitest";
 const safeFetch = vi.hoisted(() => vi.fn());
 const logs = vi.hoisted(() => ({ info: vi.fn(), warn: vi.fn() }));
 
+vi.mock("../../database/repositories/factory.js", () => ({
+  getCurrentSettingValue: () => null,
+}));
 vi.mock("../../utils/safe-outbound-fetch.js", () => ({
   safeOutboundFetch: safeFetch,
 }));