feat: enforce RBAC and harden collaboration features (#1327)

* feat: enforce RBAC and harden collaboration features

- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing

* fix: enforce RBAC across split routes

src/ui/locales/en.json

@@ -1580,7 +1580,9 @@
       "ownerAuthPrivate": "The host owner's SSH authentication is private. Use “Set personal SSH authentication” from the host menu to choose your own credential.",
       "ownerAuthShared": "The host owner has shared SSH authentication for this host. You can use it or choose your own credential from “Set personal SSH authentication.”",
       "authOverrideAction": "Set personal SSH authentication",
+      "authOverrideActionProtocol": "Set personal {{protocol}} authentication",
       "authOverrideTitle": "Personal SSH authentication",
+      "authOverrideTitleProtocol": "Personal {{protocol}} authentication",
       "authOverrideDescriptionPrivate": "The host owner's SSH credentials stay private. Choose one of your saved credentials for connections to {{host}}.",
       "authOverrideDescriptionShared": "Use the authentication shared by the host owner, or replace it with one of your saved credentials for connections to {{host}}.",
       "authOverrideCredentialLabel": "Authentication credential",
@@ -1810,7 +1812,8 @@
       "linkInvalid": "This share link is invalid, expired, or has been revoked",
       "rateLimited": "Too many attempts, please try again shortly",
       "sessionEnded": "This session has ended",
-      "readOnlyBadge": "View only"
+      "readOnlyBadge": "View only",
+      "ownerLabel": "Host owner"
     },
     "modalTitle": "Share session",
     "shareButton": "Share",
@@ -3291,6 +3294,13 @@
     "analyticsEnabledLockedDesc": "This setting is locked by the ENABLE_TELEMETRY environment variable and cannot be changed here.",
     "updateAnalyticsFailed": "Failed to update analytics setting",
     "sessionSharingGloballyEnabled": "Allow Session Sharing",
+    "auditForwardingTitle": "Forward to SIEM",
+    "auditForwardingDesc": "Ship a copy of every audit entry to an external collector as NDJSON. Local logs stay the source of truth.",
+    "auditForwardingEnvNotice": "An environment variable also configures forwarding; the URL saved here takes precedence.",
+    "auditForwardingToken": "Bearer token (optional)",
+    "auditForwardingTokenStored": "Bearer token (stored)",
+    "auditForwardingSaved": "Audit forwarding settings saved",
+    "auditForwardingSaveError": "Failed to save audit forwarding settings",
     "sessionSharingGloballyEnabledDesc": "Allow live terminal, RDP, VNC, and Telnet sessions to be shared instance-wide. Overrides every per-host sharing toggle when disabled.",
     "updateSessionSharingFailed": "Failed to update session sharing setting",
     "sessionTimeout": "Session Timeout",