fix: address CodeRabbit review findings
- Apply app search permission filter after limit (access filtering before truncation)
- Allow board-modify-all users to search apps (spotlight regression)
- Skip integration permission queries for anonymous sessions
- Add deterministic sort tie-breakers (kind, name, id)
- Extract shared integration access relations helper
- Replace double type assertion with typed lookup in savePermissions
- Add regression tests: board-modify-all app search, integration-create
bundling, global full-access branch, matrix round-trip expansion
Thomas Camlong
930d9fc489