feat: add resource-level authorization for OPC

- Add OPCAuthz module with fine-grained access control
- Users can only view/modify tasks they created or are assigned to
- Admins have full access to all resources
- Members can trigger PM agent, only admins can trigger CTO/COO
- Only admins can approve CxO-level agent executions
- Track task creator in metadata for authorization
- Add metadata column with default '{}' to tasks table
- Filter task and execution lists based on user permissions
- Add 10 integration tests for authorization logic

dashboard/backend/db/opc_db.py

@@ -96,7 +96,7 @@ async def init_db():
                 assigned_to TEXT,
                 assigned_type TEXT DEFAULT 'human',
                 tags JSONB,
-                metadata JSONB,
+                metadata JSONB DEFAULT '{}',
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                 updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                 completed_at TIMESTAMP,