feat: add batched catalog access review

[codyhartsook]

Summary

• add a batched AuthorizationService.CheckAccess RPC for advisory catalog permissions
• check namespace-only or named targets against several verbs in one request
• support Create-button, namespace-picker, and per-item action UX without capability fields on catalog resources
• generate Go and TypeScript clients without adding OSS UI behavior

Closes #2860.

Contract

Each request contains one catalog resource type, 1–4 unique verbs, and 1–100 targets:

• {namespace, name} reviews that exact resource identity without loading the resource
• {namespace} reviews whether some valid resource name could be allowed in that namespace
• results preserve target order, echo each target, and list its allowed verbs
• Protovalidate enforces enums, limits, Kubernetes names, and supported resource/verb combinations

Supported resources are AgentTemplate, Harness, and ModelConfig. Harness reviews are limited to create and delete.

Evaluation and security

The server calls CollectionAuthorizer.Scope once per verb, compiles the existing kubeauth.Matcher, and applies it locally to every target. A 100-row update/delete review is therefore one browser RPC, two scope evaluations, and 200 local matches rather than 200 authorization requests.

Reviews are advisory. Every real catalog operation reauthorizes its actual input, so cached or stale UI results cannot bypass enforcement. The server does not cache decisions, load reviewed resources, return denial reasons, or expose roles, policies, or raw scopes.

Exact review results require Scope and operation-time Check to derive from the same policy decision.

UI behavior

The enterprise UI can batch candidate namespaces to decide whether to show Create and which namespace choices to enable, then batch the visible named rows for item actions. The OSS UI does not call this RPC.

Testing

• make proto-lint
• make proto-generate
• make proto-check
• make -C go lint
• go test -short ./...
• go test -race ./core/internal/service/kubeauth ./core/internal/grpcserver ./core/pkg/app
• ./node_modules/.bin/tsc --noEmit
• GitHub test-e2e