fix(rbac): enforce the storage rights on the content routes

[shreyanshj10]

Problem

The role catalogue defines storage.content, storage.upload and storage.delete, and the built-in roles grant them, but the storage content routes checked other rights instead. Removing a storage right from a role had no effect: connection.view was enough to upload an ISO, fetch one from a URL or delete a volume, and vm.view was enough to browse storage content. The delete button in the content browser only looked at readOnly, so an admin who withheld storage.delete still let users delete ISOs, templates and backups.

Change

Route	Was	Now
storage/[storage]/content GET	vm.view	storage.content
storage/[storage]/content/[volid] DELETE	connection.view	storage.delete
storage/[storage]/download-url POST	connection.view	storage.upload
storage/[storage]/upload chunk + finalize	connection.view	storage.upload

StorageContentBrowser now also requires hasPermission('storage.delete') before showing the delete button.

The guest-perimeter fallback on the content listing from #262 is kept, just re-pointed at storage.content, so vm/tag/pool scoped callers still reach the ISO picker. The vDC storage mask and tenant filename checks are unchanged.

Two built-in roles pick up the rights they were already using via connection.view, so nobody seeded from the catalogue loses anything: VM Admin gains storage.delete, Tenant Admin gains storage.content, storage.upload and storage.delete. Existing databases are not re-seeded, so operators with customised roles will want to add these.

Not included

The issue also maps connections/[id]/ceph/* and connections/[id]/storage to storage.admin. Those endpoints feed the VM/LXC wizards, hardware handlers, dashboard widgets and the Ceph views, so gating them on a dangerous right would hide unrelated pages from every role without it. That seems like a separate decision, happy to add it here if you prefer.

Tests

content/route.test.ts and content/[volid]/route.test.ts now assert the new rights. The upload and download-url routes had no tests, so storage/[storage]/storageRights.test.ts denies the permission and checks that all three call sites require storage.upload. Each of these fails against the old constants. eslint and tsc --noEmit are clean on the changed files.

Fixes #920

[shreyanshj10]

Rebased onto the current main again so this stays mergeable. Let me know if you'd like anything changed or if the storage.admin mapping for the Ceph and storage overview routes should be included here after all.