fix(auth): initialize permissions for space bearer tokens

[agreenspan]

Space-owned bearer tokens authenticated successfully but received no Space permission grants. The production token middleware called only setupOrgPermissions for tokens without a user, so a viewer token was denied its own Space's customer list. The test harness already called both setup helpers and masked this production-path gap.

Call the existing setupSpacePermissions helper in that branch. It grants only the Space and role declared by the token. New database-backed regressions use real bearer lookup and verify own-Space access, sibling/foreign-Space denial, role restrictions and the absence of a user identity on user-only routes.

Validation:

• The own-Space request reproduced 403 before the fix and returns 200 after it; all four new tests pass.
• API typecheck passes. Adversarial review found no privilege expansion.
• bun run check was attempted and stops at 134 existing lint errors in unchanged files.
• The initial API suite reported 1,003 passing tests and three failures. Subsequent diagnosis found two count-test rules omitted their required condition (fixed separately in test: provide conditions for lens count-scope regressions #95), plus a missing local MinIO test configuration (now configured). Neither is caused by this authentication patch. The count-test repair branch passes all 1,006 API tests.

Draft pending the repository-wide verification gate.