refactor(auth): remove bot owner linkage and enforce bot-level permissions

app/schemas/auth.py

@@ -66,8 +66,8 @@ class IssuedClientTokenResponse(BaseModel):
 
 
 class CreateBotPrincipalRequest(BaseModel):
-    owner_user_id: str = Field(min_length=1)
     name: str = Field(min_length=1)
+    permission: Literal["read", "trade-write", "admin"]
     description: str | None = None
 
     @field_validator("name")
@@ -81,8 +81,8 @@ class CreateBotPrincipalRequest(BaseModel):
 
 class BotPrincipalResponse(BaseModel):
     id: str
-    owner_user_id: str
     name: str
+    permission: Literal["read", "trade-write", "admin"]
     description: str | None = None
     is_active: bool
     created_at: datetime | None = None