Stage 12A: Check Auth0 permissions on Simulation Entrypoint routes #759

Goal

Part of Stage 12A of the unified API migration. Simulation Entrypoint callers should need explicit Auth0 permissions, not just a valid token for the entrypoint audience.

Problem

• The entrypoint validates the token's audience and issuer but checks no scopes or permissions.
• It parses CallerIdentity and then discards it.
• Any valid token for the audience can reach the temporary /internal/stage12/* operator routes.

Scope

• Pass CallerIdentity into protected handlers.
• Permissions per route:
  • simulation:submit on the submit routes;
  • simulation:read on the job-polling routes;
  • stage12:operate on /internal/stage12/*.
• Enforcement flag: SIMULATION_ENTRYPOINT_ENFORCE_PERMISSIONS, strictly 0 or 1, defaulting to log-only. Log-only mode emits simulation_entry_permission_missing and allows the request; enforce mode returns 403.
• Deploy and workflow wiring, unit tests, a deployed check that runs only when enforcement is on, and documentation of the Auth0 RBAC prerequisites.

Acceptance

• Unit tests cover the per-route permission matrix, permissions vs scope claims, log-only vs enforced, and disabled auth.
• Public routes stay public.
• In log-only mode, no existing client is reported missing a permission before enforcement is switched on.

Related

• PRs: Stage 12A: Check Auth0 permissions on Simulation Entrypoint routes #758, Stage 12A: Sign-in identity and v1-anchored user associations policyengine-api#3891, Stage 12A: Sign in to app v3 and save work to the account policyengine-app-v2#1252