refactor(auth): remove bot owner linkage and enforce bot-level permissions

tests/test_users.py

@@ -168,18 +168,17 @@ class FakeUserRepo:
     def create_bot_principal(
         self,
         *,
-        owner_user_id: str,
         name: str,
+        permission: str,
         description: str | None = None,
     ) -> BotPrincipal:
-        self.get_user(owner_user_id)
         if any(item.name == name for item in self.bots.values()):
             raise ValueError(f"이미 존재하는 bot name입니다: {name}")
         now = datetime.now(timezone.utc)
         bot = BotPrincipal(
             id=f"bot-{self.next_bot_id}",
-            owner_user_id=owner_user_id,
             name=name,
+            permission=permission,
             description=description,
             is_active=True,
             created_at=now,
@@ -331,7 +330,6 @@ def test_login_and_issue_client_token_flow(monkeypatch) -> None:
 
 def test_admin_can_create_bot_and_issue_token(monkeypatch) -> None:
     repo = FakeUserRepo()
-    owner = repo.create_user("bot-owner", password_hash=hash_password("password123"), permission="trade-write")
     admin = repo.create_user("admin", password_hash=hash_password("admin123!"), permission="admin")
     client = _client_with_repo(monkeypatch, repo)
 
@@ -342,7 +340,7 @@ def test_admin_can_create_bot_and_issue_token(monkeypatch) -> None:
     bot_response = client.post(
         "/auth/bots",
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"owner_user_id": owner.id, "name": "market-bot", "description": "external execution bot"},
+        json={"name": "market-bot", "permission": "trade-write", "description": "external execution bot"},
     )
     assert bot_response.status_code == 201
     bot_id = bot_response.json()["id"]
@@ -359,12 +357,12 @@ def test_admin_can_create_bot_and_issue_token(monkeypatch) -> None:
     assert payload["token"]
     assert payload["auth_token"]["token_type"] == "bot"
     assert payload["auth_token"]["bot_principal_id"] == bot_id
+    assert payload["auth_token"]["permission"] == "read"
     assert payload["auth_token"]["expires_at"] is not None
 
 
 def test_deactivated_bot_token_is_rejected(monkeypatch) -> None:
     repo = FakeUserRepo()
-    owner = repo.create_user("bot-owner", password_hash=hash_password("password123"), permission="read")
     admin = repo.create_user("admin", password_hash=hash_password("admin123!"), permission="admin")
     client = _client_with_repo(monkeypatch, repo)
 
@@ -375,7 +373,7 @@ def test_deactivated_bot_token_is_rejected(monkeypatch) -> None:
     bot_response = client.post(
         "/auth/bots",
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"owner_user_id": owner.id, "name": "ops-bot"},
+        json={"name": "ops-bot", "permission": "read"},
     )
     assert bot_response.status_code == 201
     bot_id = bot_response.json()["id"]