migration: establish exact preserved app baseline

app/api_access.py

@@ -0,0 +1,15 @@
+from __future__ import annotations
+
+from backend.http import AccessRole, ApiRouteRegistry
+
+
+ROUTES = ApiRouteRegistry.load()
+
+
+def required_role(method: str, path: str) -> AccessRole:
+    """Compatibility access lookup backed by the authoritative route registry."""
+    route = ROUTES.resolve(method, path)
+    return route.access if route else "authenticated"
+
+
+__all__ = ["ROUTES", "AccessRole", "required_role"]