Authorize Slack query callers with BoloDB user permissions

[coderabbitai]

Summary

Add caller-specific authorization for Slack query requests.

The Slack slash-command and interactive handlers currently execute queries as install.user_id. They do not resolve the Slack caller from payload["user_id"]. Any member of an installed Slack team can therefore query workspace databases, and query history is attributed to the installer.

Required changes

• Add a durable mapping from a Slack user ID to the corresponding BoloDB user.
• In backend/app/integrations/slack/bot.py, resolve the Slack caller from payload["user_id"] for slash commands and interactive callbacks.
• Verify that the resolved BoloDB user belongs to the installation workspace.
• Enforce the queries.execute permission before starting a query.
• Execute and record the query as the resolved caller, not as install.user_id.
• Return a clear Slack response when no mapping exists or the caller lacks permission.
• Add tests for authorized callers, unmapped callers, callers outside the workspace, and callers without queries.execute.

Rationale

The Slack events route does not use the normal query-route permission dependency. Caller-specific authorization is required to prevent installed Slack workspace members from using the installer's database access.

Affected areas

• backend/app/integrations/slack/bot.py
• backend/app/routes/slack.py
• Slack installation and user persistence models
• Slack bot and route tests

Backlinks

• Pull request: Slack Intergration #288
• Review comment: Slack Intergration #288 (comment)

Requested by: @Entropy-rgb