Permissions correctness test suite

[MaximilianRau04]

Description

Permissions bugs are high-impact (data leaks between users/orgs), so they need dedicated, independent test coverage beyond docsgraph-server's own unit tests.

Proposed Solution

Build a suite that exercises permission scenarios (multi-user, multi-role, cross-org) against a running docsgraph-server instance and asserts access is correctly allowed or denied.

Acceptance Criteria

• Suite covers multi-user and multi-role access scenarios
• Suite asserts both allowed and denied access are correct
• Suite runs against a live docsgraph-server instance
• Failures clearly identify which permission check broke