feat: enforce RBAC and harden collaboration features (#1327)

* feat: enforce RBAC and harden collaboration features

- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing

* fix: enforce RBAC across split routes

src/ui/tests/sidebar/HostAuthOverrideModal.test.tsx

@@ -181,7 +181,7 @@ describe("HostAuthOverrideModal", () => {
 });
 
 describe("canOverrideHostAuth", () => {
-  it("allows every shared SSH permission level and excludes owners and non-SSH hosts", () => {
+  it("allows every shared permission level and excludes owners and disabled protocols", () => {
     for (const permissionLevel of [
       "connect",
       "view",
@@ -200,6 +200,7 @@ describe("canOverrideHostAuth", () => {
     ).toBe(false);
     expect(
       canOverrideHostAuth({ ...host, enableRdp: true } as Host, "rdp"),
-    ).toBe(false);
+    ).toBe(true);
+    expect(canOverrideHostAuth(host, "rdp")).toBe(false);
   });
 });