feat: add claim catalogs and enforce module boundaries

[PANiXiDA]

Changes

• Add shared catalogs of 20 permissions and UI sections in Common; use claim types from Core Application. Expose authenticated /api/v1/claims/permissions and /api/v1/claims/sections with { type, items } responses and validate user/role assignments against these catalogs.
• Keep sections independent of API permissions, and colocate each catalog envelope with its item response. Operations are declared individually without a CRUD factory or ResourceDefinition.
• Enforce Contracts access only from Infrastructure and Presentation, including project-reference and type checks. Contracts and Common have no project references; Domain cannot depend on Common.
• Remove unused Contracts references from Host and other Presentation projects. Keep Identity OAuth route constants in Identity.Contracts, with the original Identity Infrastructure/Presentation references.
• Expand and reorder the architecture-test README; shorten Claim Catalogs in the main README.

Validation

• GitHub CI passed for e9daa57: all test projects, architecture checks, formatting, Helm, and Sonar Quality Gate. New-code coverage: 100%; duplicated code: 0%; new issues: 0.
• CI: https://github.com/tactical-heroes/api/actions/runs/38282482789
• Local builds/tests were not run as requested.
• Local architecture checks: dotnet test --project tests/PANiXiDA.TacticalHeroes.ArchitectureTests/PANiXiDA.TacticalHeroes.ArchitectureTests.csproj.
• Local catalog checks: dotnet test --project tests/PANiXiDA.TacticalHeroes.Common.UnitTests/PANiXiDA.TacticalHeroes.Common.UnitTests.csproj and dotnet test --project tests/Identity/PANiXiDA.TacticalHeroes.Identity.UnitTests/PANiXiDA.TacticalHeroes.Identity.UnitTests.csproj.
• Local HTTP checks: dotnet test --project tests/Identity/PANiXiDA.TacticalHeroes.Identity.FunctionalTests/PANiXiDA.TacticalHeroes.Identity.FunctionalTests.csproj.

Compatibility

• /api/v1/permissions is replaced by /api/v1/claims/permissions; its flat array becomes a type/items envelope. Permission items use section/resource metadata instead of group; section labels come from /api/v1/claims/sections.
• User/role claim request shapes and existing permission codes stay unchanged. Unknown permission/section values now return HTTP 400. Existing assignments need explicit section claims before clients adopt section-based visibility. Frontend changes are separate.
• Common definitions use Authentication.Permissions / Authentication.Sections namespaces. Identity OAuth route constants and HTTP routes retain their original namespaces and values.
• No database migrations or application configuration changes. The CI coverage filter includes Common while preserving thresholds.
• Applying permission checks to existing API operations remains separate work.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T17:23:04.463254Z	e9daa57	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2debb8a22b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add a unit test for the query validator

When the architecture suite runs, ApplicationValidators_Should_HaveMatchingUnitTestFiles_When_ValidatorsAreDeclared discovers this AbstractValidator and requires a corresponding test file containing a Fact or Theory; this commit adds only GetPermissionsHandlerTests, so the suite fails until GetPermissionsQueryValidatorTests is added to the Identity unit-test project.

AGENTS.md reference: src/AGENTS.md:L1-L1

Useful? React with 👍 / 👎.

[panixida-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 100.00% Coverage (90.80% Estimated after merge)
• 0.00% Duplicated Code (2.10% Estimated after merge)

Project ID: tactical-heroes-api

View in SonarQube

[PANiXiDA]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: e9daa57c5b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".