fix(pat): close message replay to restricted tokens, filter builtin tools, reject non-object bodies

Message tail and the ASGI reconnect stream cannot tie a message to an
allowlist, so any token with a resource filter is refused there. The tools
listing now applies the allowlist to default and builtin rows as well. Token
creation answers 400 instead of 500 for a JSON body that is not an object.

docsgpt/api/asgi_auth.py

@@ -31,7 +31,8 @@ async def authenticate(
         request: The incoming Starlette request.
         pat_scope: Scope a personal access token needs for this route. Left
             unset, the route rejects PATs outright (deny by default, matching
-            the Flask rule table in ``docsgpt/api/pat/rules.py``).
+            the Flask rule table in ``docsgpt/api/pat/rules.py``). A token with
+            a resource filter is always rejected.
 
     Returns:
         tuple: ``(claims, None)`` for an authenticated caller, ``(None, None)``
@@ -52,6 +53,17 @@ async def authenticate(
                 {"success": False, "message": "Token lacks the required scope", "error": "insufficient_scope"},
                 status_code=403,
             )
+        if decoded.get("resource_filter"):
+            # These routes sit outside the Flask rule table and cannot tie what
+            # they serve to an allowlist, so a restricted token is kept out.
+            return None, JSONResponse(
+                {
+                    "success": False,
+                    "message": "This endpoint is not available to a resource-restricted token",
+                    "error": "resource_not_allowed",
+                },
+                status_code=403,
+            )
         return decoded, None
     # The denylist is a sync Redis read; keep it off the event loop.
     if settings.AUTH_TYPE == "oidc" and await anyio.to_thread.run_sync(oidc_session_denied, decoded):