Fix Bug 5: require groups:read permission for list_groups

app/routes/groups.py

@@ -21,7 +21,7 @@ router = APIRouter(prefix="/api/v1/groups", tags=["groups"])
 @router.get("")
 async def list_groups(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("groups:read")),
 ):
     """List all groups in the current tenant."""
     import uuid as _uuid