fix(arch-008,arch-009): canonical 2-segment permission schema enforced; fix dead role wildcard patterns

app/routes/permission_templates.py

@@ -23,7 +23,7 @@ router = APIRouter(prefix="/api/v1/permission-templates", tags=["permission-temp
 async def list_templates(
     entity_type: str | None = None,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:templates:read")),
+    current_user: dict = Depends(require_permission("templates:read")),
 ):
     """List all permission templates for the current tenant."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -35,7 +35,7 @@ async def list_templates(
 async def create_template(
     body: PermissionTemplateCreate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:templates:write")),
+    current_user: dict = Depends(require_permission("templates:write")),
 ):
     """Create a new permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -58,7 +58,7 @@ async def update_template(
     template_id: str,
     body: PermissionTemplateUpdate,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:templates:write")),
+    current_user: dict = Depends(require_permission("templates:write")),
 ):
     """Update an existing permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -81,7 +81,7 @@ async def update_template(
 async def delete_template(
     template_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:templates:write")),
+    current_user: dict = Depends(require_permission("templates:write")),
 ):
     """Delete a permission template."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
@@ -95,7 +95,7 @@ async def delete_template(
 async def apply_template(
     body: PermissionTemplateApply,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("permissions:templates:write")),
+    current_user: dict = Depends(require_permission("templates:write")),
 ):
     """Apply a permission template to an entity, creating entity_permissions."""
     tenant_id = uuid.UUID(current_user["tenant_id"])