fix(auth): harden confidential knowledge access checks and sensitivity filtering

backend/api-gateway/src/main/java/com/datamate/gateway/filter/UserContextFilter.java

@@ -83,11 +83,13 @@ public class UserContextFilter implements GlobalFilter, Ordered {
         String userId = String.valueOf(claims.get("userId"));
         String username = claims.getSubject();
         List<String> roles = gatewayJwtUtils.getStringListClaim(claims, "roles");
+        List<String> permissions = gatewayJwtUtils.getStringListClaim(claims, "permissions");
 
         ServerHttpRequest mutatedRequest = request.mutate()
                 .header("X-User-Id", userId)
                 .header("X-User-Name", username)
                 .header("X-User-Roles", String.join(",", roles))
+                .header("X-User-Permissions", String.join(",", permissions))
                 .build();
         return chain.filter(exchange.mutate().request(mutatedRequest).build());
     }