fix: high-severity security hardening (Phase B permissions audit)

Phase B addresses 7 high-severity gaps from the permissions audit:

- B1: Enforce tree access check on session start via can_access_tree
- B2: Replace all inline permission helpers with centralized permissions.py
- B3: Fix require_engineer_or_admin to check is_team_admin before role
- B4: Add is_active field on User with enforcement in get_current_active_user
- B5: Add admin user management endpoints (list, get, role, team-admin, deactivate, activate)
- B6: Add rate limiting on auth/invite endpoints via slowapi (disabled in DEBUG)
- B7: Implement refresh token rotation with JTI-based revocation and meaningful logout

Also reduces access token TTL from 15 to 5 minutes and updates CLAUDE.md
with SaaS/MSP context for future planning sessions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/endpoints/trees.py

@@ -12,7 +12,8 @@ from app.models.category import TreeCategory
 from app.models.tag import TreeTag
 from app.models.folder import UserFolder
 from app.schemas.tree import TreeCreate, TreeUpdate, TreeResponse, TreeListResponse, CategoryInfo
-from app.api.deps import get_current_user, require_engineer_or_admin, require_admin
+from app.api.deps import get_current_active_user, require_engineer_or_admin, require_admin
+from app.core.permissions import can_edit_tree, can_access_tree
 
 router = APIRouter(prefix="/trees", tags=["trees"])
 
@@ -98,7 +99,7 @@ def build_full_tree_response(tree: Tree) -> TreeResponse:
 @router.get("", response_model=list[TreeListResponse])
 async def list_trees(
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)],
+    current_user: Annotated[User, Depends(get_current_active_user)],
     category: Optional[str] = Query(None, description="Filter by legacy category string"),
     category_id: Optional[UUID] = Query(None, description="Filter by category ID"),
     tags: Optional[str] = Query(None, description="Comma-separated tag slugs to filter by"),
@@ -176,7 +177,7 @@ async def list_trees(
 @router.get("/categories", response_model=list[str])
 async def list_categories(
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """List all unique categories from trees the user can access.
 
@@ -196,7 +197,7 @@ async def list_categories(
 @router.get("/search", response_model=list[TreeListResponse])
 async def search_trees(
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)],
+    current_user: Annotated[User, Depends(get_current_active_user)],
     q: str = Query(..., min_length=2, description="Search query"),
     limit: int = Query(20, ge=1, le=50)
 ):
@@ -226,7 +227,7 @@ async def search_trees(
 async def get_tree(
     tree_id: UUID,
     db: Annotated[AsyncSession, Depends(get_db)],
-    current_user: Annotated[User, Depends(get_current_user)]
+    current_user: Annotated[User, Depends(get_current_active_user)]
 ):
     """Get a specific tree by ID."""
     result = await db.execute(
@@ -245,15 +246,7 @@ async def get_tree(
             detail="Tree not found"
         )
 
-    # Check access: tree must be active AND (default OR public OR author OR same team)
-    can_access = (
-        tree.is_default or
-        tree.is_public or
-        tree.author_id == current_user.id or
-        (tree.team_id == current_user.team_id and current_user.team_id is not None) or
-        current_user.is_super_admin
-    )
-    if not tree.is_active or not can_access:
+    if not tree.is_active or not can_access_tree(current_user, tree):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="You don't have access to this tree"
@@ -399,13 +392,7 @@ async def update_tree(
             detail="Tree not found"
         )
 
-    # Check if user can edit: must be author, team admin for team trees, or global admin
-    can_edit = (
-        tree.author_id == current_user.id or
-        current_user.is_super_admin or
-        (current_user.is_team_admin and tree.team_id == current_user.team_id)
-    )
-    if not can_edit:
+    if not can_edit_tree(current_user, tree):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="You can only edit your own trees"