feat: Generic CRM API tool - AI can control entire system

- Create call_crm_api tool: single tool that can call ANY CRM API endpoint
- Inject OpenAPI spec into system prompt so AI knows all available endpoints
- Always include call_crm_api in agent tools (not just via tool_ids)
- Extend get_current_user to support internal header-based auth (X-Internal-Call,
  X-Tenant-Id, X-User-Id) for AI tool API access
- No more manual tool-per-endpoint registration needed

app/deps.py

@@ -24,12 +24,40 @@ async def get_current_user(
     db: AsyncSession = Depends(get_db),
     redis: aioredis.Redis = Depends(get_redis_dep),
 ) -> dict[str, Any]:
-    """Get the current authenticated user from session cookie.
+    """Get the current authenticated user from session cookie or internal headers.
 
     Returns session data dict with user_id, tenant_id, email, name, role,
     and resolved permissions from Redis cache.
+
+    Supports internal calls via X-Internal-Call: true header with
+    X-Tenant-Id and X-User-Id headers (for AI tool API access).
     """
     settings = get_settings()
+
+    # Check for internal call (AI tool access)
+    if request.headers.get("X-Internal-Call") == "true":
+        tenant_id_str = request.headers.get("X-Tenant-Id", "")
+        user_id_str = request.headers.get("X-User-Id", "")
+        if tenant_id_str and user_id_str:
+            try:
+                tenant_id = uuid.UUID(tenant_id_str)
+                user_id = uuid.UUID(user_id_str)
+                await set_tenant_context(db, tenant_id)
+
+                from app.core.permissions import get_cached_permissions
+                resolved = await get_cached_permissions(db, redis, user_id, tenant_id)
+                return {
+                    "user_id": user_id_str,
+                    "tenant_id": tenant_id_str,
+                    "permissions": resolved.get("permissions", []),
+                    "denied_permissions": resolved.get("denied", []),
+                    "field_permissions": resolved.get("field_permissions", {}),
+                    "is_system_admin": resolved.get("is_system_admin", False),
+                    "is_active": True,
+                }
+            except (ValueError, Exception):
+                pass  # Fall through to session cookie auth
+
     session_id = request.cookies.get(settings.session_cookie_name)
     if not session_id:
         raise HTTPException(