Replace all legacy dotted permission codes (vms.view, proxmox.manage, ...)
in PermissionChecker/has_permission across app/api with the new
resource:action format (vm:view, server:manage, ...), per LEGACY_PERMISSION_MAP.
All 33 codes used by the API are now registered in the permission registry.
Also switch the /api/auth/me admin branch to get_all_permissions_v2 so the
endpoint emits permissions in the new format only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Fix all `from ..` → `from ...` in app/api/proxmox/*.py after the
proxmox.py split (PR #6) placed modules one level deeper, causing
ModuleNotFoundError on startup
- Broaden Content-Security-Policy to allow CDN sources used in templates:
cdnjs.cloudflare.com (Font Awesome), cdn.jsdelivr.net (Bootstrap,
Chart.js, xterm), fonts.googleapis.com/gstatic.com (Google Fonts),
esm.sh (noVNC) — the overly-strict CSP was blocking all icons and
charts from loading in the browser
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
