refactor(rbac): drop runtime legacy-format resolution from engine

Roles are stored in the new resource:action format and any legacy keys are
converted once at startup by the RBAC v2 DB migration (migrate_rbac_v2), so
the permission engine no longer needs to resolve legacy codes on every check.

- get_user_permissions: store role permission codes as-is (no dual add).
- has_permission: match new-format codes only; drop resolve_permission and the
  dotted-code fallbacks.
- Remove now-unused resolve_permission import in middleware.
- LEGACY_PERMISSION_MAP / convert_* are retained as one-shot DB-migration
  utilities (upgrade path), not a runtime bridge.
- Tests: adapt fixtures to new-format role permissions; assert legacy keys are
  no longer honored at request time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -96,7 +96,7 @@ def clean_database():
         user_role = Role(
             name="user", 
             display_name="User", 
-            permissions={"proxmox.view": True, "vms.view": True}, 
+            permissions={"server:view": True, "vm:view": True},
             is_system=True
         )
         db.add_all([admin_role, user_role])