feat: add internal cluster admin endpoints

backend/internal/rbac/policy_test.go

@@ -21,6 +21,8 @@ func TestCan(t *testing.T) {
 		{name: "viewer cannot power vm", role: RoleViewer, action: ActionVMPower, want: false},
 		{name: "viewer cannot create vm", role: RoleViewer, action: ActionVMCreate, want: false},
 		{name: "tenant roles cannot manage cluster", role: RoleOwner, action: ActionClusterManage, want: false},
+		{name: "operator can manage cluster", role: RoleOperator, action: ActionClusterManage, want: true},
+		{name: "operator cannot read tenant vms", role: RoleOperator, action: ActionVMRead, want: false},
 		{name: "unknown role denied", role: Role("unknown"), action: ActionVMRead, want: false},
 		{name: "unknown action denied", role: RoleOwner, action: Action("unknown.action"), want: false},
 	}
@@ -35,7 +37,7 @@ func TestCan(t *testing.T) {
 }
 
 func TestPolicyMatrix(t *testing.T) {
-	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer}
+	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer, RoleOperator}
 	actions := []Action{
 		ActionVMRead,
 		ActionVMPower,