Update webapp to call OPA to see if we can call the endpoint #332

public class OpaAuthorizationHandler : AuthorizationHandler<ProjectPermissionRequirement>
{
    private readonly HttpClient _opaClient;
    private readonly IMongoCollection<Project> _projectsCollection;

    public OpaAuthorizationHandler(HttpClient opaClient, IMongoDatabase database)
    {
        _opaClient = opaClient;
        _projectsCollection = database.GetCollection<Project>("Projects");
    }

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context, 
        ProjectPermissionRequirement requirement)
    {
        // 1. Get Project ID from HttpContext Route Values
        var httpContext = context.Resource as HttpContext;
        var projectId = httpContext.Request.RouteValues["projectId"]?.ToString();
        var userId = context.User.GetInternalUserId(); // From our claims transform!

        // 2. Fetch the user's role for this project from MongoDB
        var project = await _projectsCollection.Find(p => p.Id == projectId).FirstOrDefaultAsync();
        var userRole = project?.Members.FirstOrDefault(m => m.UserId == userId)?.Role ?? "none";

        // 3. Ask OPA for permission
        var requestBody = new {
            input = new {
                project_role = userRole,
                action = requirement.Permission,
                is_system_admin = context.User.HasClaim("Role", "SystemAdmin")
            }
        };

        // Call OPA evaluate endpoint (e.g., http://localhost:8181/v1/data/app/rbac/allow)
        var response = await _opaClient.PostAsJsonAsync("/v1/data/app/rbac/allow", requestBody);
        var opaResult = await response.Content.ReadFromJsonAsync<OpaResponse>();

        // 4. Grant or Deny based on OPA's answer
        if (opaResult?.Result == true)
        {
            context.Succeed(requirement);
        }
    }
}