Integrate subuser permission node system and refactor route-level permissions

- Add `permission_node` DTO to link classic permissions with subuser-specific nodes.
- Extend `authentication` to support subuser resolution via tokens.
- Introduce route traits for permission evaluation with subuser context.
- Update `requirePermission` and `hasPermission` to handle subuser grants dynamically.
- Implement fallback mechanisms for customer number context in subuser permissions.

services/nginx/app/classes/authentication.php

@@ -7,6 +7,7 @@ use interfaces\authentication_i;
 use objects\plate_scanners_o;
 use objects\tokens_o;
 use objects\users_o;
+use objects\subusers_o;
 
 class authentication implements authentication_i
 {
@@ -68,13 +69,17 @@ class authentication implements authentication_i
 
     public function validate_token(string $token): bool
     {
-        // Get the token from the database
-        $token = (new tokens_o())->getToken($token);
-        // Check if the token exists
-        if (!$token->id) {
-            return false;
+        // First: try validating as a classic user auth token
+        $dbToken = (new tokens_o())->getToken($token);
+        if ($dbToken && $dbToken->id) {
+            return true;
         }
-        return true;
+        // Fallback: try validating as a subuser session token
+        $subuser = (new subusers_o())->getSubuserBySessionToken($token);
+        if ($subuser !== null) {
+            return true;
+        }
+        return false;
     }
 
     /**
@@ -129,6 +134,33 @@ class authentication implements authentication_i
         return $token;
     }
 
+    /**
+     * @throws Exception
+     */
+    public function get_subuser(): subusers_o|false
+    {
+        // Try to resolve a subuser from an incoming bearer token or explicit token parameter
+        $headers = getallheaders();
+        $tmp = json_decode(file_get_contents('php://input'), true);
+        if (!is_array($tmp)) {
+            $tmp = [];
+        }
+        if (!isset($headers['Authorization']) && !isset($_GET['token']) && !isset($_POST['token']) && !isset($tmp['token'])) {
+            return false;
+        }
+        $token = $_GET['token'] ?? $headers['Authorization'] ?? $tmp['token'] ?? $_POST['token'];
+        // Strip the Bearer prefix (If the token is from the headers)
+        if (isset($headers['Authorization'])) {
+            $token = str_replace('Bearer ', '', $token);
+        }
+        // Resolve subuser session from cache
+        $subuser = (new subusers_o())->getSubuserBySessionToken($token);
+        if ($subuser === null) {
+            return false;
+        }
+        return $subuser;
+    }
+
     public function hash_password($password): string
     {
         // Hash the password