[RBAC PR 3] Add configurable default-access role to RBAC

[philipfweiss]

Tracking: #2234 (step 3 of the RBAC enablement sequence).

Stacked on #2232.

With default_access_policy=restrictive, every reques is denied unless an explicit user or group grant matches. That leaves no way to express a baseline like "everyone can read" short of flipping the whole policy back to permissive or hand-granting every principal.

This adds a configurable default-access role:

• New default_access_role setting (default None).
• AuthContext.from_user loads the named role's scopes into AuthContext.default_scopes (empty when the setting is unset or the role does not exist).
• RBACAuthorizationService resolves the principal's own scopes and the default-role scopes together; if none grant the request, it falls back to default_access_policy.
• No behavior change by default: with no default role configured, authorization is unchanged.

---

How I verifie:

Run against the PR branch with a restrictive RBAC config and the seeded Roads data. The user dj is a normal non-admin.

1. Started the PR server, restrictive policy, no default role.

AUTHORIZATION_PROVIDER=rbac \
DEFAULT_ACCESS_POLICY=restrictive \
uvicorn datajunction_server.api.main:app --port 8010   # DB env omitted

GET /health/ -> HTTP_STATUS:200

2. Logged in as non-admin dj; baseline denies both read and write.

POST /basic/login/ -> HTTP_STATUS:200
GET  /whoami/ -> {"username":"dj","is_admin":false} HTTP_STATUS:200
GET  /nodes/default.avg_repair_price/ -> HTTP_STATUS:403
POST /nodes/source/ (default namespace) -> HTTP_STATUS:403
     {"message":"Access denied to 1 resource(s): default"}

3. Created a default-access role that grants read broadly.

POST /roles/
{
  "name": "global-viewer",
  "scopes": [
    {"action": "read", "scope_type": "node", "scope_value": "*"},
    {"action": "read", "scope_type": "namespace", "scope_value": "*"}
  ]
}
-> HTTP_STATUS:201

4. Restarted the server with the role wired in as the default.

AUTHORIZATION_PROVIDER=rbac \
DEFAULT_ACCESS_POLICY=restrictive \
DEFAULT_ACCESS_ROLE=global-viewer \
uvicorn datajunction_server.api.main:app --port 8010   # DB env omitted

5. Same non-admin user now gets fallback read, while writes stay denied.

POST /basic/login/ -> HTTP_STATUS:200
GET  /nodes/default.avg_repair_price/ -> HTTP_STATUS:200
GET  /nodes/default.repair_orders/    -> HTTP_STATUS:200
GET  /nodes/default.contractors/      -> HTTP_STATUS:200
POST /nodes/source/ (default namespace) -> HTTP_STATUS:403
     {"message":"Access denied to 1 resource(s): default"}

The read flips from 403 to 200 once the default role is configured; the write stays 403 because the role grants only READ. Unsetting default_access_role, or pointing it at a role that does not exist, loads no scopes and falls back to default_access_policy.

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	76df04f
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a4c4b703da1fc00084c55e9

[shangyian]

LGTM 🚢