fix: high-severity security hardening (Phase B permissions audit)

Phase B addresses 7 high-severity gaps from the permissions audit:

- B1: Enforce tree access check on session start via can_access_tree
- B2: Replace all inline permission helpers with centralized permissions.py
- B3: Fix require_engineer_or_admin to check is_team_admin before role
- B4: Add is_active field on User with enforcement in get_current_active_user
- B5: Add admin user management endpoints (list, get, role, team-admin, deactivate, activate)
- B6: Add rate limiting on auth/invite endpoints via slowapi (disabled in DEBUG)
- B7: Implement refresh token rotation with JTI-based revocation and meaningful logout

Also reduces access token TTL from 15 to 5 minutes and updates CLAUDE.md
with SaaS/MSP context for future planning sessions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/endpoints/sessions.py

@@ -12,7 +12,8 @@ from app.models.tree import Tree
 from app.models.session import Session
 from app.models.user import User
 from app.schemas.session import SessionCreate, SessionUpdate, SessionResponse, SessionExport, ScratchpadUpdate
-from app.api.deps import get_current_user
+from app.api.deps import get_current_active_user
+from app.core.permissions import can_access_tree
 
 router = APIRouter(prefix="/sessions", tags=["sessions"])
 
@@ -20,7 +21,7 @@ router = APIRouter(prefix="/sessions", tags=["sessions"])
 @router.get("", response_model=list[SessionResponse])
 async def list_sessions(
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)],
+    current_user: Annotated[User, Depends(get_current_active_user)],
     completed: Optional[bool] = Query(None, description="Filter by completion status"),
     skip: int = Query(0, ge=0),
     limit: int = Query(50, ge=1, le=100)
@@ -46,7 +47,7 @@ async def list_sessions(
 async def get_session(
     session_id: UUID,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Get a specific session."""
     result = await db.execute(select(Session).where(Session.id == session_id))
@@ -71,7 +72,7 @@ async def get_session(
 async def start_session(
     session_data: SessionCreate,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Start a new troubleshooting session."""
     # Get the tree
@@ -90,6 +91,12 @@ async def start_session(
             detail="Cannot start session with inactive tree"
         )
 
+    if not can_access_tree(current_user, tree):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You don't have access to this tree"
+        )
+
     # Create session with tree snapshot
     new_session = Session(
         tree_id=tree.id,
@@ -115,7 +122,7 @@ async def update_session(
     session_id: UUID,
     session_data: SessionUpdate,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Update session (add decisions, notes, etc.)."""
     result = await db.execute(select(Session).where(Session.id == session_id))
@@ -154,7 +161,7 @@ async def update_session(
 async def complete_session(
     session_id: UUID,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Mark session as complete."""
     result = await db.execute(select(Session).where(Session.id == session_id))
@@ -189,7 +196,7 @@ async def update_scratchpad(
     session_id: UUID,
     data: ScratchpadUpdate,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Update session scratchpad. Accepts updates on both active and completed sessions."""
     result = await db.execute(select(Session).where(Session.id == session_id))
@@ -218,7 +225,7 @@ async def export_session(
     session_id: UUID,
     export_options: SessionExport,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Export session to formatted notes."""
     result = await db.execute(select(Session).where(Session.id == session_id))