chore: CI quality gate scripts — permission + API path consistency

P1-1 check-permissions.sh:
- Extracts permission codes from backend handlers, frontend routeConfig,
  and seed migrations
- Cross-checks consistency across all three sources
- Validates .list + .manage pairing per entity
- Current result: 26 mismatches found (seed gaps for ai/copilot/ble)

P1-2 check-api-paths.sh:
- Extracts API paths from frontend api/ and backend Axum routes
- Cross-checks frontend paths exist in backend
- Validates route parameter syntax ({param} vs :param)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/check-api-paths.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# check-api-paths.sh - Frontend API paths vs Backend routes consistency check
+#
+# Usage: bash scripts/check-api-paths.sh
+# Returns: 0=pass, 1=mismatch found
+
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+FRONTEND_PATHS=$(mktemp)
+BACKEND_ROUTES=$(mktemp)
+trap 'rm -f "$FRONTEND_PATHS" "$BACKEND_ROUTES"' EXIT
+
+echo "=========================================="
+echo "  Frontend-Backend API Path Consistency"
+echo "=========================================="
+
+# Extract frontend API paths from client.get/post/put/delete calls
+# Single-quoted paths
+grep -rohE "'\/[^']+'" apps/web/src/api/ --include="*.ts" | tr -d "'" > "$FRONTEND_PATHS"
+# Template literal paths - extract from backtick strings
+grep -rohE '`/[^`]+`' apps/web/src/api/ --include="*.ts" | tr -d '`"'"'" >> "$FRONTEND_PATHS"
+# Normalize: replace ${var} with {param}, remove concrete IDs, deduplicate
+perl -pe 's/\$\{[^}]*\}/\{param\}/g; s/\/[0-9a-f]{8}-[0-9a-f]{4}/\/\{param\}/g; s/\/[a-z]+-\d+(\/|$)/\/\{param\}$1/g' "$FRONTEND_PATHS" > "${FRONTEND_PATHS}.tmp"
+sort -u "${FRONTEND_PATHS}.tmp" > "$FRONTEND_PATHS"
+rm -f "${FRONTEND_PATHS}.tmp"
+
+# Extract backend Axum route paths from .route(), .get(), .post() etc
+grep -rohE '"/[^"]*"' crates/ --include="*.rs" \
+  | grep -E '^"/(health|ai|auth|config|workflow|message|plugin)' \
+  | tr -d '"' \
+  | sed 's/:[^\/]*/{param}/g' \
+  | sed 's/{[^}]*}/{param}/g' \
+  | sort -u > "$BACKEND_ROUTES"
+
+FE_COUNT=$(wc -l < "$FRONTEND_PATHS")
+BE_COUNT=$(wc -l < "$BACKEND_ROUTES")
+echo ""
+echo "Stats: Frontend ${FE_COUNT} paths | Backend ${BE_COUNT} routes"
+echo ""
+
+ERRORS=0
+WARNINGS=0
+
+# Check 1: Frontend paths that have no backend route
+echo "--- Check 1: Frontend paths missing from backend ---"
+while IFS= read -r fpath; do
+  [ -z "$fpath" ] && continue
+  clean_path="${fpath%/{param}}"
+  found=false
+  while IFS= read -r bpath; do
+    [ -z "$bpath" ] && continue
+    clean_bpath="${bpath%/{param}}"
+    if [ "$fpath" = "$bpath" ] || [ "$clean_path" = "$clean_bpath" ]; then
+      found=true
+      break
+    fi
+    case "$fpath" in
+      "$bpath"/*|"$clean_bpath"/*) found=true; break ;;
+    esac
+  done < "$BACKEND_ROUTES"
+  if [ "$found" = false ]; then
+    echo -e "  ${RED}MISSING${NC} Frontend '${fpath}' not found in backend routes"
+    ERRORS=$((ERRORS + 1))
+  fi
+done < "$FRONTEND_PATHS"
+
+if [ $ERRORS -eq 0 ]; then
+  echo -e "  ${GREEN}OK${NC} All frontend paths have backend routes"
+fi
+
+echo ""
+
+# Check 2: Backend route parameter format
+echo "--- Check 2: Backend route param format ---"
+bad_format=$(grep -E ':[a-z_]+[/"]' "$BACKEND_ROUTES" || true)
+if [ -n "$bad_format" ]; then
+  echo -e "  ${YELLOW}WARN${NC} Routes using old :param syntax:"
+  echo "$bad_format" | while IFS= read -r line; do echo "    $line"; done
+  WARNINGS=$((WARNINGS + 1))
+else
+  echo -e "  ${GREEN}OK${NC} All routes use {param} syntax"
+fi
+
+echo ""
+echo "=========================================="
+if [ $ERRORS -gt 0 ]; then
+  echo -e "  ${RED}FAIL${NC} ${ERRORS} mismatches, ${WARNINGS} warnings"
+  exit 1
+else
+  echo -e "  ${GREEN}PASS${NC} All paths consistent, ${WARNINGS} warnings"
+  exit 0
+fi