refactor(api): reuse web app access queries for permissions

[hjlarry]

Summary

• extend the existing framework-neutral WebAppAccessQueryService with permission decisions for /webapp/permission
• remove direct SQLAlchemy-session, WebAppAuthService, FeatureService, and Enterprise calls from the permission handler
• keep passport extraction, verification, HTTP error translation, and unexpected-error logging at the controller boundary
• normalize passport failures to web_sso_auth_required (401) and known permission dependency failures to web_app_access_unavailable (503)
• serialize permission outcomes through dump_response(BooleanResultResponse, ...)

Replacement

Replaces #40491, which GitHub automatically closed while it was in the merge queue after the lower branches in native Stack #40556 were merged and deleted.

#40482 and #40555 are now merged. This PR reapplies only #40491's three reviewed commits onto the current main; the patch is unchanged according to git range-diff.

Compatibility

• preserve the existing appId and X-App-Code requirements and error text
• preserve public and SSO-verified early access without reading a passport
• preserve private/private-all passport verification before the deployment feature gate and permission query
• preserve the visitor fallback when the passport has no user_id
• leave unexpected programming errors as 500
• reduce configured access-mode lookup from twice per request to once

The single access-mode snapshot makes the narrow concurrent private -> public transition fail closed instead of temporarily allowing access.

Validation

• 62 focused controller, service, and composition tests
• Ruff check and format check
• import-linter: 12 contracts kept, 0 broken
• response-contract lint: 486 valid, 0 mismatches
• exact three-commit git range-diff
• git diff --check

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	59.72%	59.75%	+0.02%
Strict coverage	59.30%	59.33%	+0.02%
Typed symbols	39,770	39,806	+36
Untyped symbols	27,011	27,010	-1
Modules	3175	3175	0

[github-actions]

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-08-20 01:21:36.786475036 +0000
+++ /tmp/pyrefly_pr.txt	2026-08-20 01:21:23.256435721 +0000
@@ -3861,7 +3861,7 @@
 ERROR `SimpleNamespace` is not assignable to attribute `request` with type `Request` [bad-assignment]
   --> tests/unit_tests/controllers/trigger/test_webhook.py:13:22
 ERROR Object of class `Exception` has no attribute `data` [missing-attribute]
-   --> tests/unit_tests/controllers/web/test_app.py:190:16
+   --> tests/unit_tests/controllers/web/test_app.py:192:16
 ERROR Object of class `ModuleType` has no attribute `web_ns` [missing-attribute]
   --> tests/unit_tests/controllers/web/test_message_list.py:57:9
 ERROR Object of class `ModuleType` has no attribute `WebApiResource` [missing-attribute]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.81%. Comparing base (98c2ffe) to head (356ebab).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #40984      +/-   ##
==========================================
+ Coverage   86.77%   86.81%   +0.04%     
==========================================
  Files        5198     5355     +157     
  Lines      291555   295691    +4136     
  Branches    58090    59194    +1104     
==========================================
+ Hits       253001   256715    +3714     
- Misses      33569    33992     +423     
+ Partials     4985     4984       -1     

Flag	Coverage Δ
api	86.78% <100.00%> (+0.01%)	⬆️
cli	89.33% <ø> (?)
dify-ui	93.60% <ø> (ø)
web	86.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.