feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/ws_stream_visibility_test.go

@@ -78,7 +78,7 @@ func findStreamServer(out []model.StreamServer, id uint64) *model.StreamServer {
 // Guest: no auth → skip every HideForGuest server, Host.Filter() drops
 // PlatformVersion and agent Version while keeping the rest (including GPU).
 func TestFilterServersForViewerGuestHidesPrivateAndRedactsHost(t *testing.T) {
-	out := filterServersForViewer(makeStreamTestServers(), 0, false, true)
+	out := filterServersForViewer(makeStreamTestServers(), 0, false, true, nil)
 
 	assert.Len(t, out, 2)
 	assert.Nil(t, findStreamServer(out, 2), "alice-hidden should be invisible to guests")
@@ -98,7 +98,7 @@ func TestFilterServersForViewerGuestHidesPrivateAndRedactsHost(t *testing.T) {
 func TestFilterServersForViewerNonOwnerMemberMatchesGuest(t *testing.T) {
 	servers := makeStreamTestServers()
 	carolID := uint64(300)
-	out := filterServersForViewer(servers, carolID, false, true)
+	out := filterServersForViewer(servers, carolID, false, true, nil)
 
 	assert.Len(t, out, 2)
 	assert.Nil(t, findStreamServer(out, 2))
@@ -116,7 +116,7 @@ func TestFilterServersForViewerNonOwnerMemberMatchesGuest(t *testing.T) {
 func TestFilterServersForViewerOwnerSeesOwnHiddenAndFullHost(t *testing.T) {
 	servers := makeStreamTestServers()
 	aliceID := uint64(100)
-	out := filterServersForViewer(servers, aliceID, false, true)
+	out := filterServersForViewer(servers, aliceID, false, true, nil)
 
 	assert.Len(t, out, 3, "alice sees her 2 servers + bob's 1 public server")
 	assert.Nil(t, findStreamServer(out, 4), "alice must not see bob's hidden server")
@@ -137,7 +137,7 @@ func TestFilterServersForViewerOwnerSeesOwnHiddenAndFullHost(t *testing.T) {
 // Admin: no restrictions — sees every server with full Host, regardless of owner or HideForGuest.
 func TestFilterServersForViewerAdminSeesAllWithFullHost(t *testing.T) {
 	servers := makeStreamTestServers()
-	out := filterServersForViewer(servers, 999, true, true)
+	out := filterServersForViewer(servers, 999, true, true, nil)
 
 	assert.Len(t, out, 4)
 	for _, s := range out {
@@ -149,9 +149,57 @@ func TestFilterServersForViewerAdminSeesAllWithFullHost(t *testing.T) {
 // First-tick frame includes PublicNote, subsequent frames omit it.
 // This must hold regardless of viewer.
 func TestFilterServersForViewerWithoutPublicNoteFlagOmitsNote(t *testing.T) {
-	out := filterServersForViewer(makeStreamTestServers(), 0, false, false)
+	out := filterServersForViewer(makeStreamTestServers(), 0, false, false, nil)
 
 	for _, s := range out {
 		assert.Empty(t, s.PublicNote, "follow-up frames must not include PublicNote")
 	}
 }
+
+// patAllowList implements model.APITokenAccessor: empty = unrestricted.
+type patAllowList []uint64
+
+func (p patAllowList) CanAccessServer(id uint64) bool {
+	if len(p) == 0 {
+		return true
+	}
+	for _, allowed := range p {
+		if allowed == id {
+			return true
+		}
+	}
+	return false
+}
+
+// ServerIDs lets model.DenyListSafeForLimitedPAT see the same "empty =
+// unrestricted" convention CanAccessServer encodes.
+func (p patAllowList) ServerIDs() []uint64 {
+	return []uint64(p)
+}
+
+// PAT server_ids whitelist must narrow ws/server visibility even for admins;
+// otherwise an admin-issued limited PAT still leaks every server's state.
+func TestFilterServersForViewerPATWhitelistNarrowsAdmin(t *testing.T) {
+	out := filterServersForViewer(makeStreamTestServers(), 999, true, true, patAllowList{3})
+
+	if assert.Len(t, out, 1, "admin PAT scoped to server_ids=[3] must only see server 3") {
+		assert.Equal(t, uint64(3), out[0].ID)
+	}
+	assert.Nil(t, findStreamServer(out, 1), "admin PAT must not see server 1 outside whitelist")
+	assert.Nil(t, findStreamServer(out, 2), "admin PAT must not see server 2 outside whitelist")
+	assert.Nil(t, findStreamServer(out, 4), "admin PAT must not see server 4 outside whitelist")
+}
+
+func TestFilterServersForViewerPATWhitelistNarrowsOwner(t *testing.T) {
+	out := filterServersForViewer(makeStreamTestServers(), 100, false, true, patAllowList{2})
+
+	if assert.Len(t, out, 1, "owner PAT scoped to {2} must only see server 2") {
+		assert.Equal(t, uint64(2), out[0].ID)
+	}
+	assert.Nil(t, findStreamServer(out, 1), "owner PAT must not see her own server 1 outside whitelist")
+}
+
+func TestFilterServersForViewerNilPATKeepsLegacyVisibility(t *testing.T) {
+	withNil := filterServersForViewer(makeStreamTestServers(), 999, true, true, nil)
+	assert.Len(t, withNil, 4, "no PAT must keep admin-wide visibility")
+}