refactor(permissions-edit): migrate to actionEditContext (step 5)

Cluster-3a batch-replay of the roles-edit pilot (step 4). Same shape
as roles-edit with three domain-specific deltas:

* Integer ID instead of UUID — passed to the aggregator as
  (string) $id; the lookup itself stays integer-keyed via
  PermissionService::find().
* Extra authorize context key target_is_system — pre-computed from
  the loaded permission and threaded through both the CONTEXT and
  SUBMIT authorize calls.
* Domain renames (can_update_permission / can_delete_permission,
  permission_not_found scope-key, ABILITY_ADMIN_PERMISSIONS_*).

Confirms the cluster-3a pattern: forbiddenStrategy:'deny' produces
identical Guard::deny() semantics across actions; the helper file
stays 0-diff for the second cluster-3a action; PermissionService
warmup absence is preserved (cluster 3 does not need it).

Three drift decisions reproduced verbatim: notFoundFlashScopeKey,
t() consistency on Flash::success('Permission updated'), defensive
$canManageAllPermissions = $tenantScope['scope'] === 'all'.

ActionContextCsrfPairingContractTest now covers four callers
(departments, tenants, roles, permissions) and stays green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/admin/permissions/edit($id).php

@@ -15,35 +15,52 @@ $returnTarget = requestResolveReturnTarget();
 $closeTarget = requestResolveReturnTarget('admin/permissions');
 
 $currentUserId = (int) ($session['user']['id'] ?? 0);
-$authorizationService = app(\MintyPHP\Service\Access\AuthorizationService::class);
-
 $id = (int) ($id ?? 0);
 $editTarget = requestPathWithReturnTarget("admin/permissions/edit/{$id}", $returnTarget);
+
+// Resolve the permission BEFORE the aggregator so the authorize-context can
+// carry the real target_permission_id + target_is_system flag (matches today's
+// order: lookup → CONTEXT authorize → Guard::deny()). The aggregator receives
+// a trivial finder that returns the already-loaded model so its not-found
+// branch fires only when find() returned null.
 $permission = $id > 0 ? app(\MintyPHP\Service\Access\PermissionService::class)->find($id) : null;
-if (!$permission) {
-    Flash::error('Permission not found', $closeTarget, 'permission_not_found');
-    Router::redirect($closeTarget);
-}
 $isSystemPermission = (int) ($permission['is_system'] ?? 0) === 1;
-$contextDecision = $authorizationService->authorize(PermissionAuthorizationPolicy::ABILITY_ADMIN_PERMISSIONS_EDIT_CONTEXT, [
+
-    'actor_user_id' => $currentUserId,
+$context = actionEditContext([
-    'target_permission_id' => $id,
+    'finder' => static fn (string $_id): mixed => $permission,
-    'target_is_system' => $isSystemPermission,
+    'rawId' => (string) $id,
+    'notFoundFlashKey' => 'Permission not found',
+    'notFoundRedirectPath' => $closeTarget,
+    'notFoundFlashScopeKey' => 'permission_not_found',
+    'abilityKey' => PermissionAuthorizationPolicy::ABILITY_ADMIN_PERMISSIONS_EDIT_CONTEXT,
+    'context' => [
+        'actor_user_id' => $currentUserId,
+        'target_permission_id' => $id,
+        'target_is_system' => $isSystemPermission,
+    ],
+    'viewAuthFlags' => ['can_update_permission', 'can_delete_permission'],
+    'forbiddenStrategy' => 'deny',
 ]);
-if (!$contextDecision->isAllowed()) {
+$permission = is_array($context['model']) ? $context['model'] : $permission;
-    Guard::deny();
+$capabilities = $context['capabilities'];
-}
+$tenantScope = $context['tenantScope'];
-$capabilities = $contextDecision->attribute('capabilities', []);
+$viewAuth = $context['viewAuth'];
-$canUpdatePermission = is_array($capabilities) ? (bool) ($capabilities['can_update_permission'] ?? false) : false;
+$canUpdatePermission = (bool) ($capabilities['can_update_permission'] ?? false);
-$canDeletePermission = is_array($capabilities) ? (bool) ($capabilities['can_delete_permission'] ?? false) : false;
+$canDeletePermission = (bool) ($capabilities['can_delete_permission'] ?? false);
+// Permissions-Edit konsumiert $tenantScope['ids'] bewusst NICHT — Permissions
+// sind global, kein Filter-Szenario. $canManageAllPermissions bleibt als Hook
+// fuer kuenftige Policy-Erweiterungen definiert.
+$canManageAllPermissions = $tenantScope['scope'] === 'all';
+
+$authorizationService = app(\MintyPHP\Service\Access\AuthorizationService::class);
+$rolePermissionRepository = app(\MintyPHP\Repository\Access\RolePermissionRepository::class);
+$userRoleRepository = app(\MintyPHP\Repository\Access\UserRoleRepository::class);
+$userWriteRepository = app(\MintyPHP\Repository\User\UserWriteRepository::class);
 
 $errorBag = formErrors();
 $errors = [];
 $form = $permission;
 $roles = app(RoleRepository::class)->listActive();
-$rolePermissionRepository = app(\MintyPHP\Repository\Access\RolePermissionRepository::class);
-$userRoleRepository = app(\MintyPHP\Repository\Access\UserRoleRepository::class);
-$userWriteRepository = app(\MintyPHP\Repository\User\UserWriteRepository::class);
 $selectedRoleIds = $rolePermissionRepository->listRoleIdsByPermissionId($id);
 $previousRoleIds = $selectedRoleIds;
 
@@ -89,10 +106,10 @@ if ($request->isMethod('POST')) {
         if ($syncSucceeded) {
             $action = (string) $request->body('action', 'save');
             if ($action === 'save_close') {
-                Flash::success('Permission updated', $closeTarget, 'permission_updated');
+                Flash::success(t('Permission updated'), $closeTarget, 'permission_updated');
                 Router::redirect($closeTarget);
             } else {
-                Flash::success('Permission updated', $editTarget, 'permission_updated');
+                Flash::success(t('Permission updated'), $editTarget, 'permission_updated');
                 Router::redirect($editTarget);
             }
         }