feat(cloud): manage LLM providers in database

cloud-console/src/permissions.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest";
+
+import { hasScope } from "./permissions";
+import type { CloudUser } from "./types";
+
+const baseUser: Omit<CloudUser, "scopes"> = {
+  id: "user-a",
+  username: "operator",
+  display_name: "Operator",
+  role: "operator",
+  enabled: true,
+  must_change_password: false,
+  created_at: "2026-01-01T00:00:00+00:00",
+  updated_at: "2026-01-01T00:00:00+00:00",
+  last_login_at: null,
+};
+
+describe("Provider navigation permission", () => {
+  it("requires the Provider administration scope", () => {
+    expect(hasScope({ ...baseUser, scopes: ["tasks:read"] }, "llm-providers:admin")).toBe(false);
+    expect(hasScope({ ...baseUser, scopes: ["llm-providers:admin"] }, "llm-providers:admin")).toBe(true);
+    expect(hasScope({ ...baseUser, scopes: ["*"] }, "llm-providers:admin")).toBe(true);
+  });
+});