refactor(rbac): migrate API permission checks to resource:action format

Replace all legacy dotted permission codes (vms.view, proxmox.manage, ...)
in PermissionChecker/has_permission across app/api with the new
resource:action format (vm:view, server:manage, ...), per LEGACY_PERMISSION_MAP.
All 33 codes used by the API are now registered in the permission registry.

Also switch the /api/auth/me admin branch to get_all_permissions_v2 so the
endpoint emits permissions in the new format only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api/proxmox/sdn.py

@@ -20,7 +20,7 @@ router = APIRouter()
 def get_sdn_status(
     server_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.view"))
+    current_user: User = Depends(PermissionChecker("server:view"))
 ):
     """Check if SDN is available on the server"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -52,7 +52,7 @@ def get_sdn_status(
 def get_sdn_zones(
     server_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.view"))
+    current_user: User = Depends(PermissionChecker("server:view"))
 ):
     """Get all SDN zones"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -74,7 +74,7 @@ async def create_sdn_zone(
     server_id: int,
     request: Request,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Create a new SDN zone"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -112,7 +112,7 @@ def delete_sdn_zone(
     server_id: int,
     zone: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Delete an SDN zone"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -140,7 +140,7 @@ def delete_sdn_zone(
 def get_sdn_vnets(
     server_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.view"))
+    current_user: User = Depends(PermissionChecker("server:view"))
 ):
     """Get all SDN VNets"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -162,7 +162,7 @@ async def create_sdn_vnet(
     server_id: int,
     request: Request,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Create a new SDN VNet"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -201,7 +201,7 @@ def delete_sdn_vnet(
     server_id: int,
     vnet: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Delete an SDN VNet"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -230,7 +230,7 @@ def get_sdn_subnets(
     server_id: int,
     vnet: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.view"))
+    current_user: User = Depends(PermissionChecker("server:view"))
 ):
     """Get subnets for a VNet"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -253,7 +253,7 @@ async def create_sdn_subnet(
     vnet: str,
     request: Request,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Create a subnet in a VNet"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -317,7 +317,7 @@ async def create_sdn_subnet(
 def apply_sdn_changes(
     server_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Apply pending SDN changes"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -347,7 +347,7 @@ async def update_sdn_zone(
     zone: str,
     request: Request,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Update an existing SDN zone"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -376,7 +376,7 @@ async def update_sdn_vnet(
     vnet: str,
     request: Request,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Update an existing SDN VNet"""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()
@@ -406,7 +406,7 @@ def delete_sdn_subnet(
     subnet_cidr: str,
     delete_ipam_network: bool = False,
     db: Session = Depends(get_db),
-    current_user: User = Depends(PermissionChecker("proxmox.manage"))
+    current_user: User = Depends(PermissionChecker("server:manage"))
 ):
     """Delete a subnet from a VNet. subnet_cidr uses '-' instead of '/' (e.g. 10.0.0.0-24)."""
     server = db.query(ProxmoxServer).filter(ProxmoxServer.id == server_id).first()