feat(rbac): gate AI Edge (project HTTP proxies) — list, detail, edits, WAF, delete

[yahyafakhroji]

Summary

Extends the RBAC module (merged in #1269) to the first project-scoped surface: AI Edge (HTTP proxies) and all its detail routes. This is the first consumer of scope: 'project' and the networking.datumapis.com API group — the per-check engine handled both with zero module changes; only the call-site group/scope differ.

All checks: group networking.datumapis.com, namespace default, scope: 'project' (resolves to the project control-plane via the RbacProvider already mounted on the project layout). WAF is gated on the separate trafficprotectionpolicies resource.

Coverage

Surface	Check	Treatment
AI Edge list (edge/index.tsx)	httpproxies·list	bulk usePermissionCheck; useHttpProxies + watch gated enabled: canList; RestrictedState when denied; permission-aware empty copy
New button (header + empty action)	httpproxies·create	PermissionButton (disable + tooltip); empty action hidden when denied
List row Delete	httpproxies·delete	hidden when denied (View ungated)
Detail access (edge/detail/layout.tsx)	httpproxies·get	loader gateRouteAccess → discriminated-union + RestrictedState; proxy fetch skipped when denied; records denial metric
Header Delete (ProxyHeaderActions)	httpproxies·delete	PermissionButton disable + tooltip
Overview edits — name / host header / basic auth / hostnames / origins	httpproxies·patch	edit triggers disable + tooltip
Overview WAF edit	trafficprotectionpolicies·patch	gated separately (disable + tooltip)
Overview Delete card	httpproxies·delete	DangerCard actionHidden + RestrictedOverlay / LoaderOverlay
Activity tab	—	already covered by the shared activity error-formatter (403 → restricted message)

Read-only metric widgets (sparkline / edge-requests / WAF-events / active-POPs) are not separately gated — they're tied to proxy read access.

Notes / decisions

• WAF is a distinct resource (trafficprotectionpolicies), so "edit the proxy" isn't one permission — most edits use httpproxies/patch, but the WAF dialog is gated independently. A role with proxy-edit but not WAF-edit (or vice versa) is handled accurately.
• New is gated on httpproxies/create only (the create flow also makes a traffic-protection policy; a divergent WAF-create permission would surface at submit time rather than blocking the whole flow).
• Detail loader follows the standardized gateRouteAccess + discriminated-union + wrapper/inner-component pattern (hooks stay unconditional), consistent with the org team-detail loaders.
• For project-scope checks, RbacService.resolveBaseURL uses projectId (not organizationId) to build the base, so the loader passes projectId as the org-id arg — verified harmless for project scope.
• TanStack Query dedupes the repeated httpproxies/patch checks across the overview cards into a single request (no N+1).

[github-actions]

🧪 Test Summary

Job	Status
E2E Regression	⏭️ skipped
E2E Smoke	✅ success
Unit Tests	✅ success

View workflow run

📎 Artifacts

No artifacts (all tests passed).