feat(rbac): make stack-scoped grants node-specific (#1727)

* feat(rbac): make stack-scoped grants node-specific

Qualify stack role assignments as (nodeId, stackName), migrate legacy rows to the default node, and forward bound multi-action evidence on Proxy/Pilot hops so scoped users keep least-privilege remote access without shipping the full grant table.

* fix: mirror scoped-stack-auth-evidence capability to frontend, sanitize node id in role assignment log

Backend added the scoped-stack-auth-evidence capability without the
matching frontend entry, failing the capability parity test. The role
assignment log also interpolated the node id without sanitizeForLog,
unlike the rest of the line.

* fix(rbac): honor node-wide scopes and fix proxied DELETE cleanup

Node-scoped grants now authorize that role's stack actions on the same node in the backend resolver, frontend can(), and remote evidence. Proxied DELETE cleanup uses the gate-stashed route because pathRewrite mutates req.path before proxyRes. Add proxy integration coverage and drop the stale scoped-permissions screenshot.

* fix(rbac): preserve node-qualified grants during repair

frontend/src/components/EditorLayout/ShellOverlays.tsx

@@ -25,9 +25,10 @@ interface ShellOverlaysProps {
   stackActions: StackActionsHook;
   isDarkMode: boolean;
   isAdmin: boolean;
-  can: (action: PermissionAction, resourceType?: string, resourceId?: string) => boolean;
+  can: (action: PermissionAction, resourceType?: string, resourceId?: string, nodeId?: number | null) => boolean;
   selectedFile: string | null;
   stackName: string;
+  activeNodeId: number | null;
   gitSourceOpen: boolean;
   setGitSourceOpen: (open: boolean) => void;
   canSelfUpdate: boolean;
@@ -45,6 +46,7 @@ export function ShellOverlays({
   can,
   selectedFile,
   stackName,
+  activeNodeId,
   gitSourceOpen,
   setGitSourceOpen,
   canSelfUpdate,
@@ -210,7 +212,7 @@ export function ShellOverlays({
           open={gitSourceOpen}
           onOpenChange={setGitSourceOpen}
           stackName={stackName}
-          canEdit={can('stack:edit', 'stack', stackName)}
+          canEdit={can('stack:edit', 'stack', stackName, activeNodeId)}
           isDarkMode={isDarkMode}
           onSourceChanged={stackActions.refreshGitSourcePending}
         />