pub async fn permissions_for_user( db: &Db, user_id: i64, ) -> Result<Arc<HashSet<String>>>
All permission names belonging to the given user — direct + via groups — unioned into one set. Cached for 60s.