feat: add internal cluster admin endpoints

backend/internal/rbac/policy.go

@@ -3,10 +3,11 @@ package rbac
 type Role string
 
 const (
-	RoleOwner  Role = "owner"
-	RoleAdmin  Role = "admin"
-	RoleMember Role = "member"
-	RoleViewer Role = "viewer"
+	RoleOwner    Role = "owner"
+	RoleAdmin    Role = "admin"
+	RoleMember   Role = "member"
+	RoleViewer   Role = "viewer"
+	RoleOperator Role = "operator"
 )
 
 type Action string
@@ -72,6 +73,9 @@ var permissions = map[Role]map[Action]bool{
 		ActionProjectRead,
 		ActionSSHKeyRead,
 	),
+	RoleOperator: allow(
+		ActionClusterManage,
+	),
 }
 
 func allow(actions ...Action) map[Action]bool {

backend/internal/rbac/policy_test.go

@@ -21,6 +21,8 @@ func TestCan(t *testing.T) {
 		{name: "viewer cannot power vm", role: RoleViewer, action: ActionVMPower, want: false},
 		{name: "viewer cannot create vm", role: RoleViewer, action: ActionVMCreate, want: false},
 		{name: "tenant roles cannot manage cluster", role: RoleOwner, action: ActionClusterManage, want: false},
+		{name: "operator can manage cluster", role: RoleOperator, action: ActionClusterManage, want: true},
+		{name: "operator cannot read tenant vms", role: RoleOperator, action: ActionVMRead, want: false},
 		{name: "unknown role denied", role: Role("unknown"), action: ActionVMRead, want: false},
 		{name: "unknown action denied", role: RoleOwner, action: Action("unknown.action"), want: false},
 	}
@@ -35,7 +37,7 @@ func TestCan(t *testing.T) {
 }
 
 func TestPolicyMatrix(t *testing.T) {
-	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer}
+	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer, RoleOperator}
 	actions := []Action{
 		ActionVMRead,
 		ActionVMPower,