Add RBAC, RLS, API client, global state, and auth docs to AGENTS.MD

[Copilot]

AGENTS.MD was missing critical system documentation that agents need when generating code: RBAC, RLS, API header injection, global state, auth, and the end-to-end request flow.

New sections in Core Concepts

• RBAC — Permission format (resource:action + wildcards), createRBACContext()/hasPermission()/withRBAC() usage, X-header table (x-org-id, x-app-id, x-user-id, x-user-roles, x-user-permissions), two-level cache
• RLS — Secure-by-default engine (no policy = 403), pre-built policies (TenantScoped, UserScoped, AppScoped, PublicReadOnly, AdminOnly, OwnerOnly), mandatory registerPolicy() for new models, SecurityContext interface
• API Client — defaultHeaders() auto-injects X-App-Id/X-Org-Id on every request from Jotai global store, auth token injection, in-flight dedup, ApiError helpers
• Global State — All available Jotai atoms, usage in components via useAtom(), usage outside React via globalStore.get()
• Auth — Server setup, client hooks, client actions
• Request Flow — End-to-end diagram: Component → API Client → Worker → secureCrud → RLS → ORM → D1

Updated existing sections

• Adding a New Package with Model — Now 7 steps; added step 4 (register RLS policy) and step 5 (register model in initDbConnection)
• Anti-Patterns — Added: models without RLS policy, bypassing RLS with raw Drizzle queries

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.