permission-chain

Permission chain analyzer: extracts role definitions, role check sites, middleware mounts, and mutating routes. Identifies transitive chains (role A can reach endpoint E via routes R1,R2...), surfaces unprotected mutating routes (file-local check missing), detects divergent role-naming (same role defined differently in 3 files). Read-only. Audience: Senior. Trigger: /permission-chain