Move the request-customer Authorize overloads to Web

[KrzysztofPajak]

Part of the explicit-context work in Business (after #930–#940)
Type: feature

Issue

IPermissionService.Authorize(Permission) and Authorize(string) authorize the customer of the current request. They sat on the Business interface, and PermissionService injected IContextAccessor only to serve them, so nothing stopped Business code from calling them. Outside a request (scheduled task, background handler) such a check uses a null or wrong customer. #937 documented these overloads as the last accepted remainder of M1; #940 moved the matching GetResource(name) overload to Web.

Solution

• IPermissionService (Grand.Business.Core) keeps only the overloads that take a Customer. PermissionService no longer takes IContextAccessor, so src/Business has no ambient read of the request left (the M1 grep IContextAccessor|IWorkContext over src/Business returns nothing).
• New IRequestPermissionService in Grand.Web.Common.Security.Authorization with only Authorize(Permission) and Authorize(string). RequestPermissionService wraps IPermissionService and passes WorkContext?.CurrentCustomer; a request without a work context is not authorized.
• Web filters (AuthorizeAdmin/Store/Vendor/AdminOrStore, PublicStore, ClosedStore, PermissionAuthorize), SiteMap, the admin panels (Admin, Store, Vendor, AdminShared), Grand.Web, Razor views and plugins inject IRequestPermissionService for request-customer checks. Code that already passes a customer, or reads/manages permissions, keeps IPermissionService (a class needing both injects both, e.g. CustomerGroupAclUpdateValidator). PermissionAuthorizeAction resolves the customer once and uses IPermissionService for both checks.
• Grand.Module.Api does not reference Grand.Web.Common. BaseApiController exposes CurrentCustomer (work-context customer resolved from HttpContext.RequestServices), and API controllers pass it to IPermissionService.Authorize(..., CurrentCustomer); their constructors are unchanged. AuthorizeApiAdminAttribute takes IContextAccessor.
• Authorize(string, Customer) returns false for a null customer instead of throwing, as Authorize(Permission, Customer) already did.
• .ai/ guides describe the new contract.

Breaking changes

• IPermissionService.Authorize(Permission) and Authorize(string) are removed. Plugins call them on IRequestPermissionService (Grand.Web.Common.Security.Authorization) or pass a customer. A plugin built against the old interface fails with MissingMethodException until rebuilt.
• PermissionService constructor: (IRepository<Permission>, IRepository<PermissionAction>, IGroupService, ICacheBase); IContextAccessor removed.
• Admin/Store/Vendor/AdminShared base controllers and view components take IRequestPermissionService instead of IPermissionService.

Testing

Automated: the solution builds, and dotnet test GrandNode.slnx passes. Grand.Business.Customers.Tests and Grand.Business.Marketing.Tests failed in the parallel full run and pass on their own (known parallel flake). New RequestPermissionServiceTests cover the request customer for both overloads and a request without a work context; PermissionServiceTests use an explicit customer and cover a null customer; AuthorizeApiAdminAttributeTests check the API filter authorizes the work-context customer. ContentPreviewTests swap the mock to IRequestPermissionService and also complete the controller setup (IPageHeadBuilder, Url, TempData) the blog preview path needs.

Manual (not run yet):

1. Log in to Admin, Store owner and Vendor panels: the menus show only the permitted items, and a page without permission redirects to Access denied.
2. Storefront as a guest and as a registered customer: cart and wishlist links follow the Enable shopping cart / wishlist permissions; with the store closed or not public, access follows the settings.
3. Call the API (/api/... with a token) as an admin and as a customer without the API/admin permission: 200 vs 403.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.