fix: add admin.prompt_policies to valid permissions and builtin-admin role (#303)

Migration 031 created the prompt_policies table but never registered
admin.prompt_policies in _VALID_PERMISSIONS or granted it to the
builtin-admin role, causing 403 on all prompt-policy admin endpoints.

tests/test_governance_endpoints.py

@@ -57,6 +57,7 @@ class _InjectAuthMiddleware(BaseHTTPMiddleware):
                     "admin.users",
                     "admin.orgs",
                     "admin.policies",
+                    "admin.prompt_policies",
                     "admin.skills",
                     "admin.usage",
                     "admin.audit",

tests/test_sdk_governance.py

@@ -64,6 +64,7 @@ class _InjectAuthMiddleware(BaseHTTPMiddleware):
                     "admin.roles",
                     "admin.orgs",
                     "admin.policies",
+                    "admin.prompt_policies",
                 }
             ),
         )

turnstone/console/server.py

@@ -2125,6 +2125,7 @@ _VALID_PERMISSIONS = frozenset(
         "admin.roles",
         "admin.orgs",
         "admin.policies",
+        "admin.prompt_policies",
         "admin.skills",
         "admin.audit",
         "admin.usage",

turnstone/core/storage/migrations/versions/032_prompt_policy_permission.py

@@ -0,0 +1,39 @@
+"""Grant admin.prompt_policies permission to builtin-admin role.
+
+Migration 031 created the prompt_policies table but did not add the
+corresponding permission to the builtin-admin role, causing 403 on
+/v1/api/admin/prompt-policies for all users.
+
+Revision ID: 032
+Revises: 031
+Create Date: 2026-04-05
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "032"
+down_revision = "031"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(
+        sa.text(
+            "UPDATE roles SET permissions = permissions || ',admin.prompt_policies' "
+            "WHERE role_id = 'builtin-admin' "
+            "AND permissions NOT LIKE '%admin.prompt_policies%'"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(
+        sa.text(
+            "UPDATE roles SET permissions = REPLACE(permissions, ',admin.prompt_policies', '') "
+            "WHERE role_id = 'builtin-admin'"
+        )
+    )