feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]

backend/src/MoShiro.Backend.Api/OpsEndpoints.cs

@@ -17,7 +17,7 @@ public static class OpsEndpoints
             .Api("health_get", "SQLite and the raw data directory are both writable", Tag)
             .Returns<HealthDto>().ProducesProblems(503);
         app.MapGet("/metrics", MetricsAsync)
-            .Api("metrics_get", "Prometheus metrics (admin token)", Tag)
+            .Api("metrics_get", "Prometheus metrics (requires ops.metrics)", Tag)
             .Produces(StatusCodes.Status200OK, contentType: "text/plain").ProducesProblems(401, 403);
         // 一行安装：curl -fsSL 'https://panel/install?code=…' | bash（macOS 用 zsh），irm 'https://panel/install.ps1?code=…' | iex（Windows）。
         // Agent 和 Probe 是同一份脚本，角色、网关和镜像由一次性代码决定；代码不能用就是 404。
@@ -57,11 +57,11 @@ public static class OpsEndpoints
     private static async Task<IResult> MetricsAsync(HttpContext http, OpsService ops)
     {
         Principal principal = http.GetPrincipal();
-        if (!principal.IsAdmin)
+        if (!principal.Has(Capability.OpsMetrics))
         {
-            return principal.CanRead
-                ? Problems.Create(http, MoShiroErrors.Forbidden, "an admin token is required")
-                : Problems.Create(http, MoShiroErrors.Unauthorized, "an admin token is required");
+            return principal.Kind != PrincipalKind.Anonymous
+                ? Problems.Create(http, MoShiroErrors.Forbidden, "the ops.metrics capability is required")
+                : Problems.Create(http, MoShiroErrors.Unauthorized, "authentication is required");
         }
 
         return TypedResults.Text(await ops.RenderPrometheusAsync(http.RequestAborted), "text/plain; version=0.0.4");