fix(line): fail closed when identity resolution fails

[falltwo]

Summary

LINE requests used to fall back to the warehouse role when ERP identity lookup failed. That allowed an unknown user to read operational data through the low-privilege role. This change removes the fallback: unresolved identities now reach the tool gateway without a role and are denied.

Changes

• Added line bot/line_access.py to isolate LINE role resolution and gateway authorization.
• Return no role for unknown users, blank roles, unavailable resolvers, and lookup errors.
• Reject tool calls when the resolved role is missing.
• Recheck dashboard attachments against the caller's role so a denied data source cannot reappear through a Flex message.
• Pass the resolved ERP role through text, image, audio, and postback handlers.

Verification

• GitHub Actions pytest: passed.
• Targeted LINE access tests: 23 passed.
• Full local regression suite: 345 passed.
• git diff --check: passed.
• Independent review: PASS on all 7 checks.

Scope and integration notes

backend/auth.py still grants access when it runs without a Streamlit context. Fixing that safely requires an authenticated server-side authorization context that reaches the underlying tool functions. Changing the current fallback to an unconditional denial would also block legitimate LINE and agent gateway calls.

The /trigger_morning_briefing endpoint also remains unauthenticated. Its worker calls get_ai_response(prompt) without a service role, so this change will deny its tool calls if the briefing feature is enabled. LINE_BRIEFING_ENABLED is disabled by default. The follow-up should protect the endpoint with an authenticated POST request and run the briefing under an explicit least-privilege service principal.

This PR remains a draft until those authorization paths are integrated and tested together.