refactor(auth): remove bot owner linkage and enforce bot-level permissions

app/services/auth_service.py

@@ -103,10 +103,9 @@ class AuthService:
         self._repository.revoke_auth_token(auth_context.user_id, token_id)
 
     def create_bot_principal(self, payload: CreateBotPrincipalRequest) -> BotPrincipal:
-        self._repository.get_user(payload.owner_user_id)
         return self._repository.create_bot_principal(
-            owner_user_id=payload.owner_user_id,
             name=payload.name,
+            permission=payload.permission,
             description=payload.description,
         )
 
@@ -124,16 +123,15 @@ class AuthService:
         if not bot.is_active:
             raise ValueError("비활성화된 봇에는 토큰을 발급할 수 없습니다")
 
-        owner = self._repository.get_user(bot.owner_user_id)
-        owner_permission = Permission(owner.permission)
-        requested = Permission(payload.permission or owner.permission)
-        if not _has_permission(owner_permission, requested):
-            raise ValueError("요청한 토큰 권한이 봇 소유자의 권한을 초과합니다")
+        bot_permission = Permission(bot.permission)
+        requested = Permission(payload.permission or bot.permission)
+        if not _has_permission(bot_permission, requested):
+            raise ValueError("요청한 토큰 권한이 봇 권한을 초과합니다")
 
         raw_token = generate_token()
         expires_at = self._build_expiration(payload.expires_in_days, self._settings.bot_token_default_ttl_days)
         auth_token = self._repository.create_auth_token(
-            owner.id,
+            bot.id,
             name=payload.name,
             token_hash=hash_token(raw_token),
             token_prefix=token_prefix(raw_token),