feat(BA-6834): AppConfig allow_list read/write access levels (model + migration)

[jopemachine]

Summary

Adds read_access / write_access access-level columns to app_config_allow_list (BA-6834, BEP-1052 / epic BA-5781), decoupling read-enablement from write-authorization. Until now the allow-list row's mere existence doubled as the write gate (the FK WriteNotAllowed check) while it also carried the merge rank (the read side) — conflating two orthogonal concerns and forcing the REST API to gate every fragment write to superadmin. These admin-owned tiers make who-may-read and who-may-write explicit; the row's existence now only registers a config layer.

Access levels

AppConfigAccessLevel, least → most privileged: public < authenticated < owner < admin. owner is resolved relative to the fragment's scope (the user itself for user scope, the domain admin for domain); admin (superadmin) always satisfies any tier.

Default policy per scope_type

scope_type	read_access	write_access
public	public	admin
domain	authenticated	admin
user	owner	owner

Layers

• types — AppConfigAccessLevel + AppConfigScopeType.default_read_access() / default_write_access()
• data / model — read_access / write_access on AppConfigAllowListData and the ORM row (StrEnumType, NOT NULL)
• repository — creator fills the tiers from the scope-type default policy; updater can re-policy them post-create
• migration — 3e7b1d9c4a25: add nullable → backfill by scope_type → NOT NULL (mirrors the rank migration)

Notes

• Schema only — authorization is not yet enforced against these columns. Consuming layers land in the cascade PRs.
• Migration not yet applied to a live DB in this environment (the local halfstack DB was another worktree's); run alembic upgrade head against this branch's halfstack to verify.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. ✅ feat(BA-6702): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6702): move fragment rank to the allow list with scope defaults
7. ✅ feat(BA-6701): expose allow-list rank on the v2 API surface #12517 — feat(BA-6701): expose allow-list rank on the v2 API surface
8. ✅ feat(BA-6704): cascade app config subtree deletion from the definition #12518 — feat(BA-6704): cascade app config subtree deletion from the definition
9. ✅ feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. ✅ feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): app_config_fragment bulk CRUD service layer
11. feat(BA-6810): AppConfigFragment visible-fragments query (repository layer) #12706 — feat(BA-6810): AppConfigFragment visible-fragments query (repository layer)
12. feat(BA-6555): AppConfig merge engine + resolve service (service layer) #12359 — feat(BA-6555): AppConfig merge engine + resolve service (service layer)
13. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API
14. 👉 feat(BA-6834): AppConfig allow_list read/write access levels (model + migration) #12755 — feat(BA-6834): AppConfig allow_list read/write access levels (model + migration) ← you are here
15. feat(BA-6835): expose the allow_list permission on the v2 API #12756 — feat(BA-6835): expose read/write access level on the allow_list v2 API
16. feat(BA-6860): RBAC-gate app_config fragment writes at the processors #12759 — feat(BA-6836): authorize fragment writes via allow_list write_access tier
17. feat(BA-6837): authorize fragment reads via allow_list read_access tier #12764 — feat(BA-6837): authorize fragment reads via allow_list read_access tier

AppConfig is treated as RBAC-Global with no RBAC validator; app_config_allow_list's access tiers are AppConfig's standalone authorization system.

[jopemachine]

⚠️ Superseded by #12794 — this PR did NOT actually merge to main.

GitHub auto-marked this PR "merged" during a stack reorder: the read/write access-level work was moved to the base of the AppConfig stack (below #12359), so this branch's commits became contained in its old base (feat/BA-6556) and GitHub recorded a phantom merge. Nothing reached main.

The identical work now lives in #12794 (base: main), sitting at the foundation of the stack so every layer above builds on the read/write-separated model. Please review/track there.