feat(auth): owner-bound bot tokens and self-service bot management

tests/test_portfolio_ownership.py

@@ -108,6 +108,25 @@ def test_non_owner_gets_403_on_db_auth(monkeypatch) -> None:
     assert response.json()["detail"] == "Portfolio ownership mismatch"
 
 
+def test_owner_bound_bot_token_can_read_owned_portfolio(monkeypatch) -> None:
+    token = "owner-bot-token"
+    principal = TokenPrincipal(
+        token_id="t-bot-1",
+        user_id="owner-1",
+        permission="read",
+        token_type="bot",
+        bot_principal_id="bot-1",
+    )
+    repo = FakeRepo(portfolio=_portfolio("owner-1"), principals={hash_token(token): principal})
+    client = _configure_client(monkeypatch, repo)
+
+    response = client.get("/portfolios/p1", headers={"Authorization": f"Bearer {token}"})
+
+    app.dependency_overrides.clear()
+    assert response.status_code == 200
+    assert response.json()["portfolio"]["owner_user_id"] == "owner-1"
+
+
 def test_db_enabled_env_token_without_user_context_is_rejected(monkeypatch) -> None:
     repo = FakeRepo(portfolio=_portfolio("owner-1"), principals={})
     monkeypatch.setenv("PORTFOLIOHUB_DB_ENABLED", "true")