backstage-permissionslisted

# Backstage permissions Add real authorization to a Backstage instance: permission definitions, a policy that decides, and backend enforcement points that obey. The UI never enforces anything. ## Preconditions - Repo uses the new backend system (`createBackend`, `backend.add()`). Detect first; the legacy backend wiring for permissions is different and unsupported on current lines. - Frontend generation known (NFS: `createApp` from `@backstage/frontend-defaults`, `createFrontendPlugin`, blueprints, `/alpha` exports — vs legacy `createPlugin`, `<FlatRoutes>`). It changes where UI checks are placed, not whether they matter. - `backstage.json` release line known; permission APIs moved (see step 5) and the installed packages are the source of truth, not memory. - You know which principal the endpoint serves: end users, service-to-service, or both. - Assume `yarn` from the repo root unless the repo says otherwise. ## Procedure 1. **Survey what exists.** Grep for `permission:` in `app-config*.yaml`, `@backstage/plugin-permission-backend` and `@backstage/plugin-permission-backend-module-allow-all-policy` in `packages/backend/src/index.ts`, and existing `PermissionPolicy` implementations under `packages/backend/src/extensions/`. See `backstage-repo-discovery`. 2. **Enable the framework.** Set `permission.enabled: true` in `app-config.yaml` and register `backend.add(import('@backstage/plugin-permission-backend'))`. With `enabled: false` the framework shor