feat(rbac): Add rbac frontend

[jordan-umusu]

---

Summary by cubic

Built the RBAC frontend for org and workspace access control and added scope-based UI gating across the app. Users only see and use features they have permission for, with workspace-aware checks.

• New Features

  • Added Organization “Access control” page with tabs for Roles, Groups, Scopes, Assignments, and User Assignments; added workspace Roles and Groups pages under Members with a view toggle.
  • Introduced ScopeProvider and ScopeGuard with wildcard and workspace-aware checks; wrapped org/workspace layouts and gated app/org sidebars (e.g., workflow:read, org:settings:read), including delegated workspace RBAC scopes (workspace:rbac:read/manage).
  • Implemented RBAC CRUD UI with list views, dialogs, and hooks for roles, groups, scopes, and assignments; expanded /users/me/scopes to accept an optional workspaceId.
  • Updated workspace listing to show all workspaces to org admins and only member workspaces to others.

• Bug Fixes

  • Fixed scope resolution to include workspace-scoped assignments when fetching org-level scopes, ensuring access to org resources where relevant.

^{Written for commit a8a756f. Summary will update on new commits.}

[jordan-umusu]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(rbac): Test suite #2036
• feat(rbac): Add rbac frontend #1988 👈 (View in Graphite)
• feat(rbac): Add @require_scope decorators to all API endpoints #1987
• feat(rbac): Add RBAC service and API routers #1986
• feat(rbac): Seed registry scopes during sync #1985
• feat(rbac): RBAC auth layer #1984
• feat(rbac): Add database schema for RBAC tables #1983
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.