Authorization per screen and per-request account checks #9

Goal

Enforce per-screen permissions on the server: every endpoint declares the screen and minimum level it needs, and every request checks the account and its effective access.

Scope

• ScreenAccessRequirement(ScreenKey, AccessLevel) with its authorization handler and the extension .RequireScreenAccess(ScreenKeys.X, AccessLevel.Y) (PERM-03, PERM-12, API-11, ADR-0020).
• Support for the documented exception: listing profiles with Reader on Permissões or Usuários (PERM-04).
• On every authenticated request, load the account status and effective levels from one HybridCache entry (in memory only); a non-active account gets 401 account_inactive (AUTH-18, ADR-0032).
• Cache invalidation when a user's profiles or status change, or a profile's levels change, so changes apply on the next request without signing out (PERM-13).
• Requests above the person's level get 403 forbidden.

Out of scope

The profile and user endpoints themselves (#10, #11); they only declare their requirements.

Done when

• Integration tests: allowed and denied path for each level; the PERM-04 exception; a deactivated user's next request gets 401; a lowered level applies on the next request.
• Build with zero warnings, all tests pass.

References

docs/product/features/permission-profiles.md, docs/api/conventions.md, ADR-0020, ADR-0021, ADR-0032.