Ask what the caller may do, not what its owner may do

Wave 4, first half. A personal API token scoped to endpoints.command alone
could queue system_restart, run_script and update_app against a shop-floor PC.

require_permission has always suspended the admin bypass for a scoped token,
and tests pin that. What nothing covered was a route checking a SECOND
permission by hand: the endpoints command route asked
current_user.haspermission(elevated), which reads the token's OWNER. An admin
minting a narrow token for a script therefore handed out remote restart, script
execution and app deployment - the exact bypass require_permission exists to
prevent, reintroduced one hand-rolled check at a time.

caller_holds is now scope-aware, so the answer is about the caller rather than
the person behind it: the owner must hold the permission AND, when the request
carries a scoped token, the scope list must name it. An unscoped token is the
person and is unchanged; a session is unchanged; guests still answer from the
guest role.

Both hand-rolled checks in the tree now use it - the endpoints elevated gate and
the secure-send tools.secrets check, which had the same shape and the same
consequence at a smaller scale.

Two tests, one proving the refusal and one proving an unscoped token still
passes (a fix that quietly broke every service token would be worse than the
bug). Verified by planting the owner-based check back: the first fails.

Reported by the fleet-agent lane of the 2026-09-03 test run and confirmed by an
independent verifier that minted its own token and queued its own commands.

Scope: product

shopdb/utils/authz.py

@@ -102,14 +102,27 @@ def caller_holds(permission_name: str) -> bool:
     Guests are included on purpose: a signed-out visitor holds whatever the
     guest role was granted, so the answer must come from the same place
     require_permission gets it.
+
+    Scoped personal tokens are included for the same reason, and this is the
+    half that was missing: the answer has to be about the CALLER, and a scoped
+    token is a narrower caller than its owner. Reading the owner's permissions
+    let a token scoped to endpoints.command queue a remote restart, because the
+    elevated check asked the owner rather than the token - the one bypass
+    require_permission exists to prevent, reintroduced by a route that did its
+    own check.
     """
     user = currentuser()
     if user is None:
         return guestholds(permission_name)
     try:
-        return bool(user.haspermission(permission_name))
+        if not user.haspermission(permission_name):
+            return False
+        patscopes = get_jwt().get('patscopes')
     except Exception:
         return False
+    if patscopes is not None:
+        return permission_name in patscopes
+    return True
 
 
 def require_permission(permission_name: str):