feat(rbac): complete HTTP endpoint integration + role configs

HTTP Endpoints with RBAC:
- ingest_handler: project-level write access check
- learn_handler: project-level write access check
- projects_handler: filter returned projects by user access
- query_handler: filter search results by resource access
- context_handler: project-level read access check

Example Role Configurations (config/roles/):
- admin.yaml: full access to all resources
- portfolio-agent.yaml: public visitor access
- authenticated-user.yaml: logged-in user access
- homelab-team.yaml: team-scoped project access

All 660+ tests passing.

config/roles/admin.yaml

@@ -0,0 +1,8 @@
+# Admin role: full access to all resources
+name: admin
+description: Full administrative access to all resources
+
+rules:
+  - resources: ["*"]
+    verbs: [read, write, delete, query]
+    # No scope restrictions - access everything

config/roles/authenticated-user.yaml

@@ -0,0 +1,15 @@
+# Authenticated User role: logged in via Authentik
+name: authenticated-user
+description: Logged in user with access to all public + private docs
+
+rules:
+  # Can read all wiki, embeddings, skills (including private)
+  - resources: [wiki, embedding, skill]
+    verbs: [read, query]
+    # No visibility restriction - can see public AND private
+
+  # Can manage own conversations (any project)
+  - resources: [conversation]
+    verbs: [read, write, delete]
+    scope:
+      owner: self

config/roles/homelab-team.yaml

@@ -0,0 +1,17 @@
+# Homelab Team role: full access to homelab project
+name: homelab-team
+description: Team members with full access to homelab project
+
+rules:
+  # Full read/write access to homelab wiki and skills
+  - resources: [wiki, skill, embedding]
+    verbs: [read, write, query]
+    scope:
+      projects: [homelab]
+
+  # Can manage conversations in homelab
+  - resources: [conversation]
+    verbs: [read, write, delete]
+    scope:
+      projects: [homelab]
+      # Note: no owner restriction - team can see all conversations

config/roles/portfolio-agent.yaml

@@ -0,0 +1,18 @@
+# Portfolio Agent role: public visitor access via portfolio site
+name: portfolio-agent
+description: Public visitor access - read public docs, manage own conversations
+
+rules:
+  # Can read/query public wiki and embeddings from allowed projects
+  - resources: [wiki, embedding]
+    verbs: [read, query]
+    scope:
+      projects: [homelab, rbc, aws, portfolio]
+      visibility: public
+
+  # Can read/write own conversations in portfolio project only
+  - resources: [conversation]
+    verbs: [read, write]
+    scope:
+      projects: [portfolio]
+      owner: self