Merge remote-tracking branch 'origin/master'

svc/middlewares/authz_v2.go

@@ -897,6 +897,14 @@ func AuthzGuardByRoute(pg *sql.DB) func(http.Handler) http.Handler {
 				return
 			}
 
+			// Self permission endpoints are required right after login
+			// to hydrate UI permission state for the authenticated user.
+			switch pathTemplate {
+			case "/api/permissions/routes", "/api/permissions/effective":
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			// =====================================================
 			// 3️⃣ ROUTE LOOKUP (path + method)
 			// =====================================================