fix(files): bind file namespaces to authorized runs

[sriaradhyula]

Description

Bind generic file namespaces to their stored conversation or workflow run before proxying or performing GridFS operations.

• Require the Dynamic Agents invoke gate on the BFF routes.
• Validate the namespace shape and stored resource/run pairing.
• Apply conversation, agent, and workflow-run permissions at the BFF.
• Repeat the run-pairing and caller checks in Dynamic Agents before each file operation.
• Preserve both conversation and workflow filesystem use cases.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

No chart changes.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests

Validation

• Dynamic Agents: 29 focused authorization tests passed
• UI: 3 targeted Jest suites passed (125 tests)
• RBAC matrix and living-document validation passed
• Ruff and ESLint passed
• Next.js production compilation passed; the repository current route-export type errors remain in the type phase

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[github-actions]

🧪 CAIPE UI Test Results

✅ All tests passed

🟡 Overall Coverage: 61%

📊 Detailed Coverage

Metric	Covered	Total	Percentage
Lines	35444	53624	66.09%
Statements	37850	59181	63.95%
Functions	6515	10946	59.51%
Branches	23456	43686	53.69%

✅ Test Suites

• ✅ auth-guard.test.tsx - Route protection & authorization
• ✅ token-expiry-guard.test.tsx - Token expiry handling
• ✅ dynamic-agent-client.test.ts - Dynamic Agents streaming client
• ✅ auth-utils.test.ts - Authentication utilities (100% coverage)
• ✅ auth-config.test.ts - OIDC configuration

📈 Coverage Thresholds

Threshold	Target	Current	Status
Minimum	40%	61%	✅ Pass
Good	60%	61%	✅ Pass
Excellent	80%	61%	⚠️ Below target

⚠️ Areas Needing Tests

High Priority:

• lib/streaming/* - Core stream event handling
• store/chat-store.ts - Chat state management
• store/agent-skills-store.ts - Agent skills
• lib/api-client.ts - API communication
• lib/storage-mode.ts - MongoDB/localStorage switching

Medium Priority:

• components/chat/ChatPanel.tsx - Main chat interface
• components/agent-builder/* - Agent builder UI
• lib/mongodb.ts - MongoDB integration

---

💡 Run locally: make caipe-ui-tests
📦 Full report: Check workflow artifacts

[github-actions]

ℹ️ Branch is behind main (advisory, non-blocking)

Commit: 19947a59

This branch does not yet contain the latest main. This does not fail the version-bump check — version files are bumped once the branch is updated, and GitHub branch protection still requires the branch to be up to date before merge. Use the Update branch button on this PR, or run:

git fetch origin main
git checkout prebuild/fix/file-namespace-authorization
git merge FETCH_HEAD
git push

This is a prebuild/* branch, so Helm prebuild publishing will still run so you can test the chart changes while the branch is being updated.