fix(flow-debugger): refuse method-entry Live runs for site-scoped users (#55)

Owner decision (b), 2026-11-09. An inbound API method has no site
affinity, so the F2 route-time scope only bounded routed SITE traffic;
the method's central-side effects (Database.*, ExternalSystem,
notifications) still ran for a scoped Deployer. FlowDebugRunner now
refuses FlowDebugRunMethodCommand for a site-scoped caller (site ids,
not Administrator) before the script executes, audits the refusal as a
failed InboundRequest under the operator's name, and raises
SiteScopeViolationException -> ManagementUnauthorized, so the Central
UI and the CLI (same /management command) share the gate.

The page disables the "Inbound API method" entry for scoped Deployers
with the reason (tooltip + inline note), starts them on script entry,
and ignores ?methodId= / a stored method choice. Replay and the
instance-scoped script / value-change Live runs are unchanged. The
route-time scope is kept as defence in depth.

Tests: scoped refused (in- and out-of-scope routing; script never runs,
refusal audited), unscoped/Administrator allowed, scoped Replay allowed,
scoped in-scope value-change Live still runs; bUnit for the disabled
entry, the drill-in, and the unscoped control. Mutation-proven (gate
and UI flag reverted -> 4 red).

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docs/plans/2026-09-05-flow-debugger-design.md

@@ -292,6 +292,13 @@ surface); the walker is syntax-only and never executes anything.
   **before any site traffic**; the denial is rethrown as `SiteScopeViolationException` *after* the
   inbound audit row is written, so the attempt is recorded under the operator's name.
   Administrators and unscoped users are exempt, exactly as `EnforceSiteScope` treats them.
+  **Superseded for scoped users by Gitea #55 (owner decision (b), 2026-11-09):** route-time scope only
+  bounds routed site traffic — the method's central-side effects (`Database.*`, `ExternalSystem`,
+  notifications) have no site to scope against — so a site-scoped operator is now refused a method
+  Live run outright, before the script executes (`FlowDebugRunner.IsSiteScoped`, audited failed
+  `InboundRequest` row, `SiteScopeViolationException` → `ManagementUnauthorized`). The page disables the
+  method entry for them with the reason; Replay and instance-scoped script / value-change Live runs are
+  unchanged. The route-time scope stays as defence in depth.
 - Trace payloads pass through the existing redaction policy on BOTH copies: the stored row (writer)
   and the inline Live copy (`FlowTraceCollector` applies `IAuditRedactor` and a 1 MB byte budget
   beside the 500-event cap — arch-review F1). The row-level caps are unchanged (auth headers