feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

model/cron.go

@@ -3,6 +3,7 @@ package model
 import (
 	"time"
 
+	"github.com/gin-gonic/gin"
 	"github.com/goccy/go-json"
 	"github.com/robfig/cron/v3"
 	"gorm.io/gorm"
@@ -45,3 +46,44 @@ func (c *Cron) BeforeSave(tx *gorm.DB) error {
 func (c *Cron) AfterFind(tx *gorm.DB) error {
 	return json.Unmarshal([]byte(c.ServersRaw), &c.Servers)
 }
+
+// HasPermission 扩展默认的 owner/admin 检查，使得 PAT 的 server_ids 白名单
+// 同样能收窄 cron 的列出、触发、删除路径。
+//
+// 语义按 Cover 字段分流，与 dispatch 入口（CronTrigger）的 fan-out 规则严格
+// 对齐——Servers 字段在不同 Cover 下含义完全相反：
+//
+//   - CronCoverIgnoreAll：Servers 是 allow-list；必须每个 server 都落在 PAT
+//     白名单内。空 allow-list 是「matches nothing」的退化形态，安全。
+//   - CronCoverAlertTrigger：Servers 是触发服务器 allow-list；与上同。
+//   - CronCoverAll：Servers 是 deny-list。dispatch 时 fan out 到 owner 的
+//     全部 server 再减去这个 deny-list。受限 PAT 必须保证 deny-list 已经覆
+//     盖 owner 在白名单外的所有 servers——否则 CronTrigger 会把任务发到
+//     PAT 没权限的 server 上。本方法和 controller 写侧 guard
+//     rejectImplicitCoverForLimitedPAT* / 运行时 guard
+//     enforcePATCronDispatchScope 共用 DenyListSafeForLimitedPAT，避免列表
+//     视图把越界历史/旁路写入行漏给受限 PAT。
+func (c *Cron) HasPermission(ctx *gin.Context) bool {
+	if !c.Common.HasPermission(ctx) {
+		return false
+	}
+	v, ok := ctx.Get(CtxKeyAPIToken)
+	if !ok {
+		return true
+	}
+	tok, _ := v.(APITokenAccessor)
+	if tok == nil {
+		return true
+	}
+	switch c.Cover {
+	case CronCoverAll:
+		return DenyListSafeForLimitedPAT(tok, c.GetUserID(), c.Servers)
+	default:
+		for _, id := range c.Servers {
+			if !tok.CanAccessServer(id) {
+				return false
+			}
+		}
+		return true
+	}
+}