feat(l1): add require_l1, require_l1_or_coverage, require_l1_or_above deps

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/api/deps.py

@@ -199,6 +199,53 @@ async def require_engineer_or_admin(
     )
 
 
+async def require_l1(
+    current_user: Annotated[User, Depends(get_current_active_user)]
+) -> User:
+    """L1 tech exact-match (with super_admin bypass for support)."""
+    if current_user.is_super_admin:
+        return current_user
+    if current_user.account_role != "l1_tech":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="L1 tech role required",
+        )
+    return current_user
+
+
+async def require_l1_or_coverage(
+    current_user: Annotated[User, Depends(get_current_active_user)]
+) -> User:
+    """L1 endpoints: l1_tech, owners, super_admin, or engineers with can_cover_l1=True."""
+    if current_user.is_super_admin:
+        return current_user
+    role = current_user.account_role
+    if role == "l1_tech":
+        return current_user
+    if role == "owner":
+        return current_user
+    if role == "engineer" and current_user.can_cover_l1:
+        return current_user
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="L1 access requires l1_tech role or engineer coverage flag",
+    )
+
+
+async def require_l1_or_above(
+    current_user: Annotated[User, Depends(get_current_active_user)]
+) -> User:
+    """Any tier from l1_tech upward (l1_tech, engineer, owner, super_admin)."""
+    if current_user.is_super_admin:
+        return current_user
+    if current_user.account_role in ("l1_tech", "engineer", "owner"):
+        return current_user
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="L1 or above required",
+    )
+
+
 async def require_team_admin(
     current_user: Annotated[User, Depends(get_current_active_user)]
 ) -> User: