fix(rbac): auto-create RLS policy on user creation

[KinshukSS2]

PR Description

Summary

POST /Users now automatically attaches the user's default RLS policy in the same transaction as user creation. No separate POST /Policies call is required.

---

What changed

api/app/v1/endpoints/create/user.py

Added _POLICY_FN_MAP (module-level constant) and a policy dispatch block after the GRANT statement:

_POLICY_FN_MAP = {
    "viewer":      "sensorthings.viewer_policy",
    "editor":      "sensorthings.editor_policy",
    "obs_manager": "sensorthings.obs_manager_policy",
    "sensor":      "sensorthings.sensor_policy",
}

After GRANT, app_role is captured before get_db_role_for_rbac() remaps it, then:

policy_fn = _POLICY_FN_MAP.get(app_role)

if policy_fn:
    await connection.execute(
        f"SELECT {policy_fn}($1, $2);",
        [user["username"]],
        f"{user['username']}_default",
    )

Notes

• Administrator role is intentionally skipped — admins bypass RLS by privilege.
• Policy functions already exist in the DB (istsos_auth.sql). No migration needed.
• The call is inside the existing transaction, so failure rolls back atomically.

---

api/app/v1/endpoints/functions.py

Docstrings added to:

• _validate_role_identifier()
• set_role()

---

api/tests/test_rls_policy_creation.py (new, 12 tests)

Covers:

• Correct function dispatch per role
• Administrator exclusion
• {username}_default naming convention
• users_ passed as list[str] (maps to text[])

---

api/tests/test_rbac_set_role_safety.py (new, 8 tests)

Covers:

• set_role() identifier validation
• Safe identifiers pass
• Injection payloads raise ValueError
• data_array_observation confirmed to use shared helper

---

Context

The set_role() SQL injection fix was already merged upstream (cbbcd78) before this PR.

The unique change here is the auto-policy dispatch in create_user().

---

Testing

python -m pytest api/tests/test_rls_policy_creation.py api/tests/test_rbac_set_role_safety.py -v

Result

20 passed, 0 failed