[API] Add rbac.restrict_all_users_mutations to reserve -u for admins

[SeungjinYang]

Summary

• Adds an opt-in API server config, rbac.restrict_all_users_mutations (default false), that reserves the --all-users/-u flag on mutating commands for admins: sky down -u, sky stop -u, sky autostop -u, sky cancel -u, sky jobs cancel -u. Without it, any user can tear down or cancel a teammate's work in a single command.
• Read-only uses of -u (sky status, sky queue, sky jobs queue) are unaffected — this restricts what a user may do, not what they may see.
• Admins are exempt, as is a server with no per-user identity (local/single-user, or auth terminated upstream). That exemption reuses role_filter.request_owner_scope, which the rest of RBAC already treats as "unrestricted caller".

rbac:
  restrict_all_users_mutations: true

Enforcement is split, by necessity

Command	Where it's enforced
sky cancel -u, sky jobs cancel -u	Server — all_users is in the request body, so POST /cancel and POST /jobs/cancel reject with 403. Holds for SDK callers.
sky down/stop/autostop -u	Client — these expand -u into one request per cluster in _down_or_stop_clusters, so the server never receives the flag and cannot reject it.

For those three the check is therefore a guardrail, not a boundary: a caller driving the Python SDK directly is not stopped by it. The CLI drives it off a per-caller flag surfaced on GET /api/health (already resolved server-side, so the client never has to reason about roles; an older server omits the field and the client defaults to false). This is called out in the docstring and in the config docs, which point at workspaces as the hard isolation mechanism.

Making down/stop/autostop server-enforced needs a per-resource ownership check rather than a flag check — deliberately out of scope here, and a reasonable follow-up.

Implementation notes

• sky/server/requests/role_filter.py — the two 403 gates are Depends() shims, matching the existing force_caller_scope_cancel_body; the decision needs the caller's role, which only the dispatch context has.
• No dashboard change: it has no all-users mutation affordance, it acts per-resource.

Test plan

Automated (55 pass):

pytest tests/unit_tests/test_sky/server/test_role_filter.py \
       tests/unit_tests/test_sky/users/test_rbac.py \
       tests/unit_tests/test_sky/test_cli_restrict_all_users.py

covering: restricted user denied, admin allowed, flag off by default, no-auth server allowed, -a/--all never gated, and the CLI gate firing for all five commands.

Also ran a FastAPI TestClient against both endpoints to confirm the request body still parses as JSON through the new Depends, and that restricted → 403, admin → 200, config-off → 200.

Manual:

1. Set rbac.restrict_all_users_mutations: true in ~/.sky/config.yaml; sky api stop && sky api start.
2. As a non-admin, confirm each of sky down -u, sky stop -u, sky autostop -u, sky cancel <cluster> -u, sky jobs cancel -u is refused with a message naming the config key.
3. Confirm sky status -u, sky queue <cluster> -u, sky jobs queue -u and every -a/--all variant still work.
4. Repeat step 2 as an admin; all five are allowed.
5. Unset the key, restart, confirm every -u works for everyone (default behavior unchanged).

🤖 Generated with Claude Code

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.