fix(pat): close message replay to restricted tokens, filter builtin tools, reject non-object bodies

Message tail and the ASGI reconnect stream cannot tie a message to an
allowlist, so any token with a resource filter is refused there. The tools
listing now applies the allowlist to default and builtin rows as well. Token
creation answers 400 instead of 500 for a JSON body that is not an object.

tests/api/test_pat_rules.py

@@ -230,6 +230,12 @@ class TestResourceRestrictions:
         assert _denied(_call(client, "GET", f"/api/agents/{AGENT_A}/schedules", claims)) is None
         assert _denied(_call(client, "GET", f"/api/agents/{AGENT_B}/schedules", claims)) == "resource_not_allowed"
 
+    @pytest.mark.parametrize("family", ["agents", "sources", "prompts", "tools", "workflows"])
+    def test_message_tail_is_closed_to_any_restricted_token(self, client, family):
+        claims = _claims(["chat:run"], {family: [AGENT_A]})
+        assert _denied(_call(client, "GET", "/api/messages/m1/tail", claims)) == "resource_not_allowed"
+        assert _denied(_call(client, "GET", "/api/messages/m1/tail", _claims(["chat:run"]))) is None
+
     def test_sql_paged_listing_is_closed_to_restricted_tokens(self, client):
         claims = self._restricted(["sources:read"], sources=[SOURCE_A])
         assert _denied(_call(client, "GET", "/api/sources/paginated", claims)) == "resource_not_allowed"