clm-permissions-rbac

How permissions and RBAC work in draftLegal — the p(A.X, R.Y) action/resource pattern in apps/api/src/lib/permissions.ts, the requirePermission middleware, the system-role refresh dance (apps/api/scripts/refresh-system-role-perms.ts) that syncs all 219 system roles, when to add a new action vs reuse existing (the sign vs configure split is the canonical case), org-scoped queries discipline, and cross-org isolation…