fix(pat): close message replay to restricted tokens, filter builtin tools, reject non-object bodies

Message tail and the ASGI reconnect stream cannot tie a message to an
allowlist, so any token with a resource filter is refused there. The tools
listing now applies the allowlist to default and builtin rows as well. Token
creation answers 400 instead of 500 for a JSON body that is not an object.

tests/api/test_asgi_auth.py

@@ -156,3 +156,11 @@ class TestPersonalAccessTokens:
             decoded, error = await asgi_auth.authenticate(_request(), pat_scope="chat:run")
         denied.assert_not_called()
         assert error is None and decoded is not None
+
+    async def test_restricted_token_is_refused_even_with_the_scope(self):
+        claims = dict(_PAT_CLAIMS, resource_filter={"agents": ["a1"]})
+        with patch.object(asgi_auth, "handle_auth", return_value=claims):
+            decoded, error = await asgi_auth.authenticate(_request(), pat_scope="chat:run")
+        assert decoded is None
+        assert error.status_code == 403
+        assert json.loads(error.body)["error"] == "resource_not_allowed"

tests/api/test_pat_routes.py

@@ -118,6 +118,11 @@ class TestCreate:
     def test_validation(self, client, db, body):
         assert _create(client, **body).status_code == 400
 
+    @pytest.mark.parametrize("body", [[1], "text", 5])
+    def test_non_object_body_is_a_client_error(self, client, db, body):
+        with _session():
+            assert client.post("/api/user/tokens", json=body).status_code == 400
+
     def test_duplicate_name_conflicts(self, client, db):
         assert _create(client).status_code == 201
         assert _create(client).status_code == 409

tests/api/test_pat_rules.py

@@ -230,6 +230,12 @@ class TestResourceRestrictions:
         assert _denied(_call(client, "GET", f"/api/agents/{AGENT_A}/schedules", claims)) is None
         assert _denied(_call(client, "GET", f"/api/agents/{AGENT_B}/schedules", claims)) == "resource_not_allowed"
 
+    @pytest.mark.parametrize("family", ["agents", "sources", "prompts", "tools", "workflows"])
+    def test_message_tail_is_closed_to_any_restricted_token(self, client, family):
+        claims = _claims(["chat:run"], {family: [AGENT_A]})
+        assert _denied(_call(client, "GET", "/api/messages/m1/tail", claims)) == "resource_not_allowed"
+        assert _denied(_call(client, "GET", "/api/messages/m1/tail", _claims(["chat:run"]))) is None
+
     def test_sql_paged_listing_is_closed_to_restricted_tokens(self, client):
         claims = self._restricted(["sources:read"], sources=[SOURCE_A])
         assert _denied(_call(client, "GET", "/api/sources/paginated", claims)) == "resource_not_allowed"