Fix route permission instance calls (#344)

## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.

services/nginx/app/routes/rolesRoute.php

@@ -17,7 +17,7 @@ class rolesRoute
         self::get('/roles', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('list_roles');
+            $this->requirePermission('list_roles');
             $user = (new authentication())->get_user();
             if ($user) {
                 (new logs_o())->add('roles', 'global', 1, 0, 'ROLES', 'User accessed the roles list');
@@ -54,7 +54,7 @@ class rolesRoute
         self::post('/roles', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('add_role');
+            $this->requirePermission('add_role');
             $user = (new authentication())->get_user();
             if ($user) {
                 (new logs_o())->add('roles', 'global', 1, 0, 'ROLES', 'User added a role');
@@ -80,7 +80,7 @@ class rolesRoute
         self::put('/roles', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('edit_role');
+            $this->requirePermission('edit_role');
             $user = (new authentication())->get_user();
             if ($user) {
                 self::requireParameters(['id']);
@@ -109,8 +109,8 @@ class rolesRoute
 
         self::get('/roles/limited-backoffice-permission-templates', function () {
             global $response;
-            self::requirePermission('superuser');
-            self::requirePermission('add_role_permission');
+            $this->requirePermission('superuser');
+            $this->requirePermission('add_role_permission');
             $user = (new authentication())->get_user();
             if ($user) {
                 (new logs_o())->add('roles', 'global', 1, $user->id, 'ROLES', 'User accessed limited backoffice role permission templates');
@@ -129,7 +129,7 @@ class rolesRoute
         self::post('/roles/permissions', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('add_role_permission');
+            $this->requirePermission('add_role_permission');
             $user = (new authentication())->get_user();
             if ($user) {
                 self::requireParameters(['group_id', 'permission_id']);
@@ -154,7 +154,7 @@ class rolesRoute
         self::delete('/roles/permissions', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('delete_role_permission');
+            $this->requirePermission('delete_role_permission');
             $user = (new authentication())->get_user();
             if ($user) {
                 self::requireParameters(['group_id', 'permission_id']);
@@ -181,7 +181,7 @@ class rolesRoute
         self::post('/roles/clone', function () {
             // Require the user to be logged in
             global $response;
-            self::requirePermission('clone_role');
+            $this->requirePermission('clone_role');
             $user = (new authentication())->get_user();
             if ($user) {
                 self::requireParameters(['id']);