Merge remote-tracking branch 'origin/pr/399' into aether-rust-pioneer

# Conflicts:
#	crates/aether-data/src/lifecycle/bootstrap/postgres.rs
#	crates/aether-data/src/lifecycle/migrate/tests.rs

apps/aether-gateway/src/control/tests/admin_core.rs

@@ -1,5 +1,7 @@
 use http::Uri;
 
+use crate::control::management_token_required_permission;
+
 use super::{classify_control_route, headers};
 
 #[test]
@@ -497,6 +499,58 @@ fn classifies_admin_list_management_tokens_as_admin_proxy_route() {
     assert!(!decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn classifies_admin_management_token_write_routes_and_permission_catalog() {
+    let headers = headers(&[]);
+    let cases = [
+        (
+            http::Method::GET,
+            "/api/admin/management-tokens/permissions/catalog",
+            "permissions_catalog",
+            "admin:management_tokens:read",
+        ),
+        (
+            http::Method::POST,
+            "/api/admin/management-tokens",
+            "create_token",
+            "admin:management_tokens:write",
+        ),
+        (
+            http::Method::PUT,
+            "/api/admin/management-tokens/token-123",
+            "update_token",
+            "admin:management_tokens:write",
+        ),
+        (
+            http::Method::POST,
+            "/api/admin/management-tokens/token-123/regenerate",
+            "regenerate_token",
+            "admin:management_tokens:write",
+        ),
+    ];
+
+    for (method, path, expected_kind, expected_permission) in cases {
+        let uri: Uri = path.parse().expect("uri should parse");
+        let decision =
+            classify_control_route(&method, &uri, &headers).expect("route should classify");
+
+        assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+        assert_eq!(
+            decision.route_family.as_deref(),
+            Some("management_tokens_manage")
+        );
+        assert_eq!(decision.route_kind.as_deref(), Some(expected_kind));
+        assert_eq!(
+            decision.auth_endpoint_signature.as_deref(),
+            Some("admin:management_tokens")
+        );
+        assert_eq!(
+            management_token_required_permission(&method, &decision).as_deref(),
+            Some(expected_permission)
+        );
+    }
+}
+
 #[test]
 fn classifies_admin_ldap_config_get_as_admin_proxy_route() {
     let headers = headers(&[]);