Refactor route authorization around scopes

[saltbo]

What changed

• remove the custom route access classification and credential allowlists
• require every non-public OpenAPI business route to declare at least one scope
• authorize Better Auth user sessions through site/team roles without synthesizing scopes
• authorize OAuth, API key, downloader, bootstrap, and task-upload credentials through their granted scopes
• expose the scope contract through x-zpan-auth and fail tests when an OpenAPI operation omits it
• update route declarations, authorization tests, and the image-hosting scope specification

Why

The authorization layer mixed route categories, credential types, roles, and scopes. That made the scope contract incomplete and prevented newly granted Agent capabilities from being controlled solely by scopes. The new model branches by authentication method: user sessions use role checks, while delegated credentials use scope checks.

Validation

• pnpm lint
• pnpm typecheck
• pnpm lint:http
• pnpm lint:arch
• pnpm lint:spec
• pnpm openapi:client:check
• pnpm test — 5309 passed
• pnpm test:cf — 79 passed
• pnpm exec playwright test e2e/agent-access.spec.ts — 4 passed
• pnpm build

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	zpan	d4641e7	Commit Preview URL Branch Preview URL	Jul 30 2026, 03:07 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.45%. Comparing base (e50c190) to head (d4641e7).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #544      +/-   ##
==========================================
+ Coverage   93.43%   93.45%   +0.02%     
==========================================
  Files         277      277              
  Lines       15369    15328      -41     
  Branches     4383     4355      -28     
==========================================
- Hits        14360    14325      -35     
+ Misses       1009     1003       -6     

Flag	Coverage Δ
integration	85.28% <89.55%> (-0.06%)	⬇️
unit	52.18% <79.10%> (+0.16%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.