refactor: rebuild backend around role-site authorization model

backend/app/api/me.py

@@ -3,10 +3,10 @@ from sqlalchemy.exc import SQLAlchemyError
 from sqlalchemy.orm import Session
 
 from app.db.session import get_db
-from app.repositories.permissions_repo import PermissionsRepository
 from app.repositories.users_repo import UsersRepository
+from app.repositories.user_sites_repo import UserSitesRepository
 from app.schemas.auth import KeycloakPrincipal, MeSummaryResponse
-from app.schemas.permissions import PermissionSnapshotResponse
+from app.schemas.permissions import RoleSnapshotResponse
 from app.security.idp_jwt import require_authenticated_principal
 from app.services.permission_service import PermissionService
 
@@ -26,10 +26,10 @@ def get_me(
             email=principal.email,
             display_name=principal.name or principal.preferred_username,
             is_active=True,
+            status="active",
         )
         return MeSummaryResponse(sub=user.user_sub, email=user.email, display_name=user.display_name)
     except SQLAlchemyError:
-        # DB schema compatibility fallback for local bring-up.
         return MeSummaryResponse(
             sub=principal.sub,
             email=principal.email,
@@ -37,14 +37,14 @@ def get_me(
         )
 
 
-@router.get("/permissions/snapshot", response_model=PermissionSnapshotResponse)
+@router.get("/permissions/snapshot", response_model=RoleSnapshotResponse)
 def get_my_permission_snapshot(
     principal: KeycloakPrincipal = Depends(require_authenticated_principal),
     db: Session = Depends(get_db),
-) -> PermissionSnapshotResponse:
+) -> RoleSnapshotResponse:
     try:
         users_repo = UsersRepository(db)
-        perms_repo = PermissionsRepository(db)
+        user_sites_repo = UserSitesRepository(db)
 
         user = users_repo.upsert_by_sub(
             user_sub=principal.sub,
@@ -52,8 +52,23 @@ def get_my_permission_snapshot(
             email=principal.email,
             display_name=principal.name or principal.preferred_username,
             is_active=True,
+            status="active",
         )
-        permissions = perms_repo.list_by_user(user.id, user.user_sub)
-        return PermissionService.build_snapshot(user_sub=principal.sub, permissions=permissions)
+        rows = user_sites_repo.get_user_role_rows(user.id)
+        serialized = [
+            (
+                site.site_key,
+                site.display_name,
+                company.company_key,
+                company.display_name,
+                system.system_key,
+                system.name,
+                role.role_key,
+                role.name,
+                role.idp_role_name,
+            )
+            for site, company, role, system in rows
+        ]
+        return PermissionService.build_role_snapshot(user_sub=principal.sub, rows=serialized)
     except SQLAlchemyError:
-        return PermissionSnapshotResponse(user_sub=principal.sub, permissions=[])
+        return RoleSnapshotResponse(user_sub=principal.sub, roles=[])