Expose effective system actions to the client

Why: Non-root managers need the system-management entry and controls to follow their explicit grants.

Evidence: The full Backend test suite passed and /api/me action projection is covered by the grant-isolation test.

Impact: /api/me now returns only the current actor system actions evaluated by the same authorizer.

Refs: Focused role and permission system task 7

internal/authz/service.go

@@ -76,3 +76,16 @@ func (s *Service) AuthorizeSystem(actor, actionID string) Decision {
 	decision.Reason = "not-granted"
 	return decision
 }
+
+func (s *Service) EffectiveSystemActions(actor string) []string {
+	actions := []string{}
+	for _, descriptor := range catalog.Catalog() {
+		if descriptor.Scope != catalog.ScopeSystem {
+			continue
+		}
+		if decision := s.AuthorizeSystem(actor, descriptor.ActionID); decision.Allowed {
+			actions = append(actions, descriptor.ActionID)
+		}
+	}
+	return actions
+}

internal/server/role_authorization_test.go

@@ -82,6 +82,10 @@ func TestSystemUserActionsDoNotImplyRoleOrPermissionManagement(t *testing.T) {
 	if rec := bearerRequest(h, "GET", "/api/admin/roles", "", key); rec.Code != http.StatusForbidden {
 		t.Fatalf("users.view read roles: %d %s", rec.Code, rec.Body.String())
 	}
+	if rec := bearerRequest(h, "GET", "/api/me", "", key); rec.Code != http.StatusOK ||
+		!strings.Contains(rec.Body.String(), `"systemActions":["system.users.view"]`) {
+		t.Fatalf("me system actions: %d %s", rec.Code, rec.Body.String())
+	}
 	if rec := bearerRequest(h, "GET", "/api/authz/explain?action=system.users.view", "", key); rec.Code != http.StatusOK {
 		t.Fatalf("explain: %d %s", rec.Code, rec.Body.String())
 	} else {

internal/server/server.go

@@ -885,6 +885,7 @@ func (s *Server) me(w http.ResponseWriter, r *http.Request) {
 		out["isAdmin"] = st.IsAdmin
 		out["mustChangePassword"] = st.MustChangePassword
 		out["passwordSet"] = st.HasPassword
+		out["systemActions"] = s.authorizer.EffectiveSystemActions(owner)
 	}
 	writeJSON(w, http.StatusOK, out)
 }