refactor(creates-batch): migrate roles/permissions/tenants-create (step 10)

Cluster-7 batch-replay of the departments-create pilot (step 9). All
three remaining create actions follow the same shape with minor
domain-specific variations.

Each migration touches one action and one policy:

* roles-create + RoleAuthorizationPolicy::authorizeAdminRolesCreate —
  policy previously returned bare allow() with no capabilities; now
  emits ['can_view_page' => true]. Action passes viewAuthFlags: [].
* permissions-create + PermissionAuthorizationPolicy::authorizeAdminPermissionsCreate —
  same pattern as roles-create.
* tenants-create + TenantAuthorizationPolicy::authorizeAdminTenantsCreate —
  policy already emitted can_manage_sso + can_manage_custom_fields;
  can_view_page is added as the first capability. Action passes
  viewAuthFlags: ['can_manage_sso', 'can_manage_custom_fields'] and
  materializes both booleans from the aggregator capabilities.

All three policy updates are tautological — every actor that survives
the deny() branches in each policy can by definition see the page.
View, Create, and EditContext now share a consistent capability shape
across all four core master-data domains (departments, roles,
permissions, tenants).

Three drift decisions reproduced:
* notFoundFlashScopeKey is N/A (no model lookup in create flows).
* t() consistency: Flash::success('Role created' / 'Permission created'
  / 'Tenant created') now flow through t().
* Defensive scope consumption: $canManageAllTenants reads
  $tenantScope['scope'] === 'all' as a resilient hook even where the
  policy emits no manage-all flag (roles/permissions are global,
  tenants-create has no filter logic). Inline comments document the
  intentional non-consumption of $tenantScope['ids'].

Two contract-test pattern updates (AuthzAdminMasterDataContractTest +
AuthzAdminTenantsContractTest) shift the assertion targets from
AuthorizationService::class to actionCreateContext( — semantically
equivalent because the aggregator wraps the same authorize call
internally.

ActionContextCsrfPairingContractTest now covers nine callers
(five edits + four creates) and stays green. Helper file
core/Support/helpers/action_context.php is 0-diff for the seventh
consecutive migration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Service/Access/PermissionAuthorizationPolicy.php

@@ -62,7 +62,11 @@ class PermissionAuthorizationPolicy implements AuthorizationPolicyInterface
             return AuthorizationDecision::deny(403, 'forbidden');
         }
 
-        return AuthorizationDecision::allow();
+        return AuthorizationDecision::allow([
+            'capabilities' => [
+                'can_view_page' => true,
+            ],
+        ]);
     }
 
     private function authorizeAdminPermissionsEditContext(array $context): AuthorizationDecision

core/Service/Access/RoleAuthorizationPolicy.php

@@ -62,7 +62,11 @@ class RoleAuthorizationPolicy implements AuthorizationPolicyInterface
             return AuthorizationDecision::deny(403, 'forbidden');
         }
 
-        return AuthorizationDecision::allow();
+        return AuthorizationDecision::allow([
+            'capabilities' => [
+                'can_view_page' => true,
+            ],
+        ]);
     }
 
     private function authorizeAdminRolesEditContext(array $context): AuthorizationDecision

core/Service/Access/TenantAuthorizationPolicy.php

@@ -111,6 +111,7 @@ class TenantAuthorizationPolicy implements AuthorizationPolicyInterface
 
         return AuthorizationDecision::allow([
             'capabilities' => [
+                'can_view_page' => true,
                 'can_manage_custom_fields' => $this->hasPermission($actorUserId, PermissionService::CUSTOM_FIELDS_MANAGE),
                 'can_manage_sso' => $this->hasPermission($actorUserId, PermissionService::TENANTS_SSO_MANAGE),
             ],