iam: seed network.border.* permissions + owner bindings (0067)

Calque of migration 0053 (network.lb permissions): border is the second
network resource driven by project owners. Creates the four
network.border.{read,create,update,delete} permissions and binds them to
the owner role, so realm managers (and the ecosystem service user, via the
element manifest) can drive borders.

Author: gmelikov

migrations/0067-border-permissions-d4a7b2.py

@@ -0,0 +1,90 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import uuid as sys_uuid
+
+from restalchemy.storage.sql import migrations
+
+# Same namespace/role/project as 0053 (network.lb permissions): border is
+# the second network resource driven by project owners (and, via manifest
+# bindings, by the ecosystem's service user for managed realms).
+NS_UUID = sys_uuid.UUID("dfd0c604-607f-4260-981f-374f88435ea0")
+OWNER_ROLE_UUID = "726f6c65-0000-0000-0000-000000000002"
+
+BORDER_PERMISSIONS = (
+    ("network.border.read", "List and read borders (NAT gateways)"),
+    ("network.border.create", "Create borders (NAT gateways)"),
+    ("network.border.update", "Update borders (NAT gateways)"),
+    ("network.border.delete", "Delete borders (NAT gateways)"),
+)
+
+
+def _u(name: str) -> str:
+    return str(sys_uuid.uuid5(NS_UUID, name))
+
+
+COMPUTE_PROJECT_UUID = _u("GenesisCore-Compute-Project")
+
+
+class MigrationStep(migrations.AbstarctMigrationStep):
+    def __init__(self):
+        self._depends = ["0066-border-inline-rules-c9a3d1.py"]
+
+    @property
+    def migration_id(self):
+        return "d4a7b2c8-11f3-4b6e-9c0d-8f2f5f8a1e42"
+
+    @property
+    def is_manual(self):
+        return False
+
+    def upgrade(self, session):
+        for name, description in BORDER_PERMISSIONS:
+            session.execute(f"""
+                INSERT INTO iam_permissions (
+                    uuid, name, description
+                ) VALUES (
+                    '{_u(name)}',
+                    '{name}',
+                    '{description}'
+                )
+                ON CONFLICT (uuid) DO NOTHING;
+            """)
+            session.execute(f"""
+                INSERT INTO iam_binding_permissions (
+                    uuid, role, permission, project_id
+                ) VALUES (
+                    '{_u("binding." + name)}',
+                    '{OWNER_ROLE_UUID}',
+                    '{_u(name)}',
+                    '{COMPUTE_PROJECT_UUID}'
+                )
+                ON CONFLICT (uuid) DO NOTHING;
+            """)
+
+    def downgrade(self, session):
+        for name, _ in BORDER_PERMISSIONS:
+            session.execute(f"""
+                DELETE FROM iam_binding_permissions
+                WHERE permission = '{_u(name)}';
+            """)
+            session.execute(f"""
+                DELETE FROM iam_permissions
+                WHERE uuid = '{_u(name)}';
+            """)
+
+
+migration_step = MigrationStep()