feat(auth): integrate normalizePermissionKeys for consistent permission handling

- Updated auth, admin, and auth-guards routes to utilize normalizePermissionKeys for permissions.
- Enhanced permission mapping to ensure legacy keys are correctly transformed to current catalog keys.
- Improved overall permission validation and user access management across the application.

packages/shared/src/contracts/auth.ts

@@ -244,6 +244,32 @@ export function allPermissionKeys(): string[] {
   return keys
 }
 
+/** Old bgp section ids → current catalog (peers/apply/settings renamed). */
+const LEGACY_PERMISSION_MAP: Record<string, string> = {
+  'bgp:peers:read': 'bgp:network:read',
+  'bgp:peers:write': 'bgp:network:write',
+  'bgp:apply:write': 'bgp:operations:admin',
+  'bgp:settings:admin': 'bgp:tenant_settings:admin',
+}
+
+/**
+ * Map legacy keys and drop anything not in the current catalog.
+ * Safe for JWT issue and admin save after catalog changes.
+ */
+export function normalizePermissionKeys(
+  permissions: readonly string[],
+): string[] {
+  const allowed = new Set(allPermissionKeys())
+  const out = new Set<string>()
+  for (const raw of permissions) {
+    const mapped = LEGACY_PERMISSION_MAP[raw] ?? raw
+    if (allowed.has(mapped)) {
+      out.add(mapped)
+    }
+  }
+  return [...out].sort()
+}
+
 export const permissionKeySchema = z
   .string()
   .regex(/^[a-z]+:[a-z0-9_]+:(read|write|admin)$/)