Remediate the 2026-09-03 feature-test findings

plugins/endpoints/api/routes.py

@@ -1376,8 +1376,13 @@ def enqueue_endpoint_command(asset_id: int):
     # Destructive actions (for example system_restart) demand a stricter grant
     # ON TOP OF endpoints.command, so a remote reboot cannot ride the routine
     # toggle permission.
+    # caller_holds, not current_user.haspermission: the question is what THIS
+    # caller may do, and a scoped personal token is a narrower caller than its
+    # owner. Asking the owner let a token scoped to endpoints.command queue a
+    # remote restart, a script run and an app deploy - the exact bypass
+    # require_permission exists to prevent, reintroduced by checking by hand.
     elevated = elevated_permission_for(action)
-    if elevated and not current_user.haspermission(elevated):
+    if elevated and not caller_holds(elevated):
         return error_response(
             ErrorCodes.FORBIDDEN,
             f'Action {action!r} requires the {elevated} permission',