refactor(rbac): drop runtime legacy-format resolution from engine

Roles are stored in the new resource:action format and any legacy keys are
converted once at startup by the RBAC v2 DB migration (migrate_rbac_v2), so
the permission engine no longer needs to resolve legacy codes on every check.

- get_user_permissions: store role permission codes as-is (no dual add).
- has_permission: match new-format codes only; drop resolve_permission and the
  dotted-code fallbacks.
- Remove now-unused resolve_permission import in middleware.
- LEGACY_PERMISSION_MAP / convert_* are retained as one-shot DB-migration
  utilities (upgrade path), not a runtime bridge.
- Tests: adapt fixtures to new-format role permissions; assert legacy keys are
  no longer honored at request time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/test_api_vms.py

@@ -62,9 +62,10 @@ class TestAPIVirtualMachines:
         # First restrict user's permissions to 'vms.view.own'
         user_role = seed_users["user"].role
         old_perms = dict(user_role.permissions)
-        # We need both 'vms.view' (to pass the endpoint route dependency) 
-        # and 'vms.view.own' (to fail the `require_vm_access` owner check).
-        user_role.permissions = {"proxmox.view": True, "vms.view": True, "vms.view.own": True}
+        # We need both 'vm:view' (to pass the endpoint route dependency)
+        # and the 'vms.view.own' ownership flag (to fail the `require_vm_access`
+        # owner check, which reads that key directly).
+        user_role.permissions = {"server:view": True, "vm:view": True, "vms.view.own": True}
         db_session.commit()
         
         response = client.get(