refac: debt on role backend

features/roles_permissions_foundation.feature

@@ -13,7 +13,7 @@ Feature: Roles and permissions foundation: catalogue, built-in roles, backfills
       - Role {ID uint32, Name, Description, BuiltIn bool, Locked bool, Version uint32, Grants}
       - the sentinels ErrRoleNotFound and ErrUnknownPermission
       - the Repository interface (list, get by id, get by name, list grants, create, save)
-      - the pure function Role.Allows(key, owned bool) bool
+      - the pure function Role.Allows(key, owned bool) bool (superseded by roles_permissions_content_scope: Role.Allows and AllowsFor are removed, a role is evaluated through Role.GrantSet(), ScopeFor and Permits)
     And the catalogue is (kind: S = scoped none/own/all, B = on/off, "owner-only" = Owner only):
       | group    | key                         | kind | owner-only |
       | content  | content.read                | S    | no  |
@@ -51,7 +51,7 @@ Feature: Roles and permissions foundation: catalogue, built-in roles, backfills
       | system   | system.edit_retention       | B    | yes |
       | system   | system.transfer_ownership   | B    | yes |
     And content permissions are stored under wildcard keys meaning "all content types"; per-type
-      overrides of the form content.<action>:<type_key> are deferred to slice 3
+      overrides of the form content.<action>:<type_key> are deferred to slice 3 (the read side is implemented by roles_permissions_content_scope; writing them stays in slice 3)
     And a role stores one row per granted key, with scope own or all. A key with no row is none or off.
       An on/off key that is on is stored as scope all.
     And three built-in roles are seeded by persistence/database (like SeedDefaultSite), idempotently,
@@ -75,7 +75,7 @@ Feature: Roles and permissions foundation: catalogue, built-in roles, backfills
       authtoken.Verifier, container.apiKeyAuth(), authtoken.Authenticator, RequireCurrentToken and
       RequireVerifiedUser. It has no role check yet
 
-  Scenario Outline: Role.Allows evaluates scope and ownership
+  Scenario Outline: Role.Allows evaluates scope and ownership (superseded by roles_permissions_content_scope: the same rows are decided by GrantSet.Permits)
     Given a role whose grant for "<key>" is "<scope>"
     When Allows("<key>", owned=<owned>) is evaluated
     Then the result is <allowed>
@@ -90,12 +90,12 @@ Feature: Roles and permissions foundation: catalogue, built-in roles, backfills
       | content.create | all   | false | true    |
       | schema.view    | none  | false | false   |
 
-  Scenario: A key absent from the role is not allowed
+  Scenario: A key absent from the role is not allowed (superseded by roles_permissions_content_scope: decided by GrantSet.Permits)
     Given a role with no grants
     When Allows("content.read", owned=true) is evaluated
     Then the result is false
 
-  Scenario: An unknown key is rejected, never silently allowed
+  Scenario: An unknown key is rejected, never silently allowed (superseded by roles_permissions_content_scope: decided by GrantSet.Permits)
     Given a role with grants for every catalogue key at all
     When Allows("content.explode", owned=true) is evaluated
     Then the result is false