feat(auth): integrate portal JWT for enhanced authentication and authorization

Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations.

Co-authored-by: Cursor <[email protected]>

internal/store/ownership.go

@@ -0,0 +1,37 @@
+package store
+
+// Ownership helpers for portal JWT resource scoping.
+
+// SeesAllOwned is true for API keys and portal admins (no per-user filter).
+func SeesAllOwned(kind string, isAdmin bool) bool {
+	if kind != "jwt" {
+		return true
+	}
+	return isAdmin
+}
+
+// CanAccessOwned reports whether the actor may see/edit a resource with createdBy.
+// Empty createdBy (legacy/API-key-created) is visible only when SeesAllOwned.
+func CanAccessOwned(kind string, isAdmin bool, userID, createdBy string) bool {
+	if SeesAllOwned(kind, isAdmin) {
+		return true
+	}
+	if createdBy == "" {
+		return false
+	}
+	return createdBy == userID
+}
+
+// FilterOwnedStrings keeps items whose owner matches the actor.
+func FilterOwned[T any](items []T, owner func(T) string, kind string, isAdmin bool, userID string) []T {
+	if SeesAllOwned(kind, isAdmin) {
+		return items
+	}
+	out := make([]T, 0, len(items))
+	for _, it := range items {
+		if CanAccessOwned(kind, isAdmin, userID, owner(it)) {
+			out = append(out, it)
+		}
+	}
+	return out
+}