fix(critical): permission cache returns None causing 500 on every authenticated API call

- get_cached_permissions() returned None when _get_current_permission_version failed
- deps.py get_current_user() crashed with AttributeError: NoneType.get()
- Fix: fall through to DB resolution instead of returning None
- Fix: add None guard in deps.py as safety net

app/core/permissions.py

@@ -340,7 +340,7 @@ async def get_cached_permissions(
                         exc_info=True,
                     )
                     await redis.delete(cache_key)
-                    return None  # Fall through to re-resolution from DB
+                    # Fall through to re-resolution from DB (don't return None)
 
                 if cached_version == current_version:
                     return data

app/deps.py

@@ -125,6 +125,8 @@ async def get_current_user(
 
     user_id = uuid.UUID(session_data["user_id"])
     resolved = await get_cached_permissions(db, redis, user_id, tenant_id)
+    if not resolved:
+        resolved = {"permissions": [], "denied": [], "field_permissions": {}, "is_system_admin": False}
     session_data["permissions"] = resolved.get("permissions", [])
     session_data["denied_permissions"] = resolved.get("denied", [])
     session_data["field_permissions"] = resolved.get("field_permissions", {})